{
  "components": {
    "schemas": {
      "ActionResponse": {
        "properties": {
          "investigation_id": {
            "title": "Investigation Id",
            "type": "string"
          },
          "message": {
            "title": "Message",
            "type": "string"
          },
          "success": {
            "title": "Success",
            "type": "boolean"
          }
        },
        "required": [
          "success",
          "message",
          "investigation_id"
        ],
        "title": "ActionResponse",
        "type": "object"
      },
      "AdapterEvent": {
        "description": "One Wazuh (or equivalent) event forwarded by the tenant adapter.",
        "properties": {
          "asset_ids": {
            "items": {
              "type": "string"
            },
            "title": "Asset Ids",
            "type": "array"
          },
          "decoder": {
            "anyOf": [
              {
                "maxLength": 128,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Decoder"
          },
          "description": {
            "anyOf": [
              {
                "maxLength": 1024,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "entities": {
            "items": {
              "$ref": "#/components/schemas/WireEntity"
            },
            "maxItems": 64,
            "title": "Entities",
            "type": "array"
          },
          "full_log": {
            "anyOf": [
              {
                "maxLength": 4096,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Full Log"
          },
          "initial_iocs": {
            "items": {
              "$ref": "#/components/schemas/IngestedIOC"
            },
            "title": "Initial Iocs",
            "type": "array"
          },
          "mitre": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/WireMitre"
              },
              {
                "type": "null"
              }
            ]
          },
          "observed_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Observed At"
          },
          "raw": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Raw"
          },
          "redaction_version": {
            "anyOf": [
              {
                "maxLength": 16,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Redaction Version"
          },
          "rule_groups": {
            "items": {
              "type": "string"
            },
            "maxItems": 16,
            "title": "Rule Groups",
            "type": "array"
          },
          "rule_id": {
            "anyOf": [
              {
                "maxLength": 64,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Rule Id"
          },
          "severity": {
            "maximum": 15.0,
            "minimum": 0.0,
            "title": "Severity",
            "type": "integer"
          },
          "source": {
            "default": "wazuh",
            "maxLength": 32,
            "title": "Source",
            "type": "string"
          },
          "source_event_id": {
            "maxLength": 128,
            "title": "Source Event Id",
            "type": "string"
          },
          "template_hash": {
            "anyOf": [
              {
                "maxLength": 64,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Template Hash"
          },
          "template_version": {
            "anyOf": [
              {
                "maxLength": 16,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Template Version"
          },
          "title": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Title"
          },
          "ts": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ts"
          }
        },
        "required": [
          "source_event_id",
          "severity"
        ],
        "title": "AdapterEvent",
        "type": "object"
      },
      "AdapterHeartbeatPayload": {
        "properties": {
          "health": {
            "title": "Health",
            "type": "string"
          },
          "metrics": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Metrics"
          },
          "tenant_id": {
            "format": "uuid",
            "title": "Tenant Id",
            "type": "string"
          },
          "version": {
            "title": "Version",
            "type": "string"
          }
        },
        "required": [
          "tenant_id",
          "version",
          "health"
        ],
        "title": "AdapterHeartbeatPayload",
        "type": "object"
      },
      "AdminResetResponse": {
        "properties": {
          "must_change": {
            "default": true,
            "title": "Must Change",
            "type": "boolean"
          },
          "temporary_password": {
            "title": "Temporary Password",
            "type": "string"
          },
          "user_id": {
            "title": "User Id",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "temporary_password"
        ],
        "title": "AdminResetResponse",
        "type": "object"
      },
      "AgentIssuance": {
        "description": "Credentials + install hint the MSSP gives the tenant admin out-of-band.\n\nThe tenant admin runs one Helm install with this payload; the agent\nself-registers against L1 (``control_plane_url``), picks up an\n``install_helm_release`` job, and deploys ``soctalk-tenant`` into\nL2's cluster.\n\nNote on scope: ``agent_chart_ref`` / ``agent_chart_version`` are the\ncoordinates for the ``soctalk-cloud-agent`` chart \u2014 what the tenant\nadmin installs in L2. The tenant SOC stack (``soctalk-tenant``) is\ndispatched by the agent itself once registered and is not exposed\nhere; it lives on the ``TenantInstallation`` row for operator\nobservability via ``GET /api/mssp/tenants/{id}``.",
        "properties": {
          "agent_chart_ref": {
            "title": "Agent Chart Ref",
            "type": "string"
          },
          "agent_chart_version": {
            "title": "Agent Chart Version",
            "type": "string"
          },
          "bootstrap_expires_at": {
            "title": "Bootstrap Expires At",
            "type": "string"
          },
          "bootstrap_token": {
            "title": "Bootstrap Token",
            "type": "string"
          },
          "control_plane_url": {
            "title": "Control Plane Url",
            "type": "string"
          },
          "helm_install_hint": {
            "title": "Helm Install Hint",
            "type": "string"
          },
          "installation_id": {
            "title": "Installation Id",
            "type": "string"
          },
          "tenant_id": {
            "title": "Tenant Id",
            "type": "string"
          }
        },
        "required": [
          "installation_id",
          "tenant_id",
          "bootstrap_token",
          "bootstrap_expires_at",
          "control_plane_url",
          "agent_chart_ref",
          "agent_chart_version",
          "helm_install_hint"
        ],
        "title": "AgentIssuance",
        "type": "object"
      },
      "AlertDTO": {
        "properties": {
          "ai_assessment": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ai Assessment"
          },
          "ai_confidence": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ai Confidence"
          },
          "event_count": {
            "title": "Event Count",
            "type": "integer"
          },
          "first_event_at": {
            "format": "date-time",
            "title": "First Event At",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "investigation_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Investigation Id"
          },
          "last_event_at": {
            "format": "date-time",
            "title": "Last Event At",
            "type": "string"
          },
          "rule_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Rule Id"
          },
          "severity": {
            "title": "Severity",
            "type": "integer"
          },
          "source": {
            "title": "Source",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "tenant_id": {
            "title": "Tenant Id",
            "type": "string"
          }
        },
        "required": [
          "id",
          "tenant_id",
          "source",
          "rule_id",
          "severity",
          "event_count",
          "ai_assessment",
          "ai_confidence",
          "status",
          "investigation_id",
          "first_event_at",
          "last_event_at"
        ],
        "title": "AlertDTO",
        "type": "object"
      },
      "AnalystMessageRequest": {
        "properties": {
          "body": {
            "maxLength": 16000,
            "minLength": 1,
            "title": "Body",
            "type": "string"
          }
        },
        "required": [
          "body"
        ],
        "title": "AnalystMessageRequest",
        "type": "object"
      },
      "AssumeTenantRequest": {
        "properties": {
          "slug": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Slug"
          },
          "tenant_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Id"
          }
        },
        "title": "AssumeTenantRequest",
        "type": "object"
      },
      "BrandingRead": {
        "properties": {
          "app_name": {
            "title": "App Name",
            "type": "string"
          },
          "favicon_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Favicon Url"
          },
          "logo_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Logo Url"
          },
          "primary_color": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Primary Color"
          },
          "secondary_color": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Secondary Color"
          }
        },
        "required": [
          "app_name"
        ],
        "title": "BrandingRead",
        "type": "object"
      },
      "BrandingUpdate": {
        "properties": {
          "app_name": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "App Name"
          },
          "favicon_url": {
            "anyOf": [
              {
                "maxLength": 500,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Favicon Url"
          },
          "logo_url": {
            "anyOf": [
              {
                "maxLength": 500,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Logo Url"
          },
          "primary_color": {
            "anyOf": [
              {
                "maxLength": 16,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Primary Color"
          },
          "secondary_color": {
            "anyOf": [
              {
                "maxLength": 16,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Secondary Color"
          }
        },
        "title": "BrandingUpdate",
        "type": "object"
      },
      "CancelRequest": {
        "properties": {
          "reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reason"
          }
        },
        "title": "CancelRequest",
        "type": "object"
      },
      "CaseDetail": {
        "properties": {
          "active_run": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/CaseRunDTO"
              },
              {
                "type": "null"
              }
            ]
          },
          "assignee_user_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Assignee User Id"
          },
          "closed_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Closed At"
          },
          "facts": {
            "additionalProperties": true,
            "title": "Facts",
            "type": "object"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "opened_at": {
            "format": "date-time",
            "title": "Opened At",
            "type": "string"
          },
          "related_cases": {
            "items": {
              "additionalProperties": true,
              "type": "object"
            },
            "title": "Related Cases",
            "type": "array"
          },
          "reopen_window_until": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reopen Window Until"
          },
          "severity": {
            "title": "Severity",
            "type": "integer"
          },
          "short_id": {
            "title": "Short Id",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "summary": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Summary"
          },
          "tenant_id": {
            "title": "Tenant Id",
            "type": "string"
          },
          "title": {
            "title": "Title",
            "type": "string"
          }
        },
        "required": [
          "id",
          "short_id",
          "title",
          "status",
          "severity",
          "opened_at",
          "closed_at",
          "assignee_user_id",
          "tenant_id",
          "summary",
          "reopen_window_until",
          "facts",
          "related_cases"
        ],
        "title": "CaseDetail",
        "type": "object"
      },
      "CaseEventDTO": {
        "properties": {
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "event_id": {
            "title": "Event Id",
            "type": "string"
          },
          "kind": {
            "title": "Kind",
            "type": "string"
          },
          "payload": {
            "additionalProperties": true,
            "title": "Payload",
            "type": "object"
          },
          "seq": {
            "title": "Seq",
            "type": "integer"
          },
          "visibility": {
            "title": "Visibility",
            "type": "string"
          }
        },
        "required": [
          "event_id",
          "seq",
          "kind",
          "payload",
          "visibility",
          "created_at"
        ],
        "title": "CaseEventDTO",
        "type": "object"
      },
      "CaseRunDTO": {
        "properties": {
          "dollars_budget": {
            "title": "Dollars Budget",
            "type": "number"
          },
          "dollars_used": {
            "title": "Dollars Used",
            "type": "number"
          },
          "ended_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ended At"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "last_error": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Last Error"
          },
          "started_at": {
            "format": "date-time",
            "title": "Started At",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "tokens_budget": {
            "title": "Tokens Budget",
            "type": "integer"
          },
          "tokens_used": {
            "title": "Tokens Used",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "status",
          "tokens_used",
          "tokens_budget",
          "dollars_used",
          "dollars_budget",
          "started_at",
          "ended_at",
          "last_error"
        ],
        "title": "CaseRunDTO",
        "type": "object"
      },
      "CaseSummary": {
        "properties": {
          "assignee_user_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Assignee User Id"
          },
          "closed_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Closed At"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "opened_at": {
            "format": "date-time",
            "title": "Opened At",
            "type": "string"
          },
          "severity": {
            "title": "Severity",
            "type": "integer"
          },
          "short_id": {
            "title": "Short Id",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "tenant_id": {
            "title": "Tenant Id",
            "type": "string"
          },
          "title": {
            "title": "Title",
            "type": "string"
          }
        },
        "required": [
          "id",
          "short_id",
          "title",
          "status",
          "severity",
          "opened_at",
          "closed_at",
          "assignee_user_id",
          "tenant_id"
        ],
        "title": "CaseSummary",
        "type": "object"
      },
      "CheckpointBody": {
        "properties": {
          "batch_seq": {
            "anyOf": [
              {
                "minimum": 0.0,
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Batch Seq"
          },
          "cursor_event_id": {
            "anyOf": [
              {
                "maxLength": 128,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Cursor Event Id"
          },
          "cursor_ts": {
            "anyOf": [
              {
                "maxLength": 64,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Cursor Ts"
          },
          "dropped_total": {
            "anyOf": [
              {
                "minimum": 0.0,
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Dropped Total"
          },
          "source": {
            "default": "wazuh",
            "maxLength": 32,
            "title": "Source",
            "type": "string"
          },
          "tenant_id": {
            "format": "uuid",
            "title": "Tenant Id",
            "type": "string"
          }
        },
        "required": [
          "tenant_id"
        ],
        "title": "CheckpointBody",
        "type": "object"
      },
      "ClaimedRun": {
        "properties": {
          "alert": {
            "additionalProperties": true,
            "title": "Alert",
            "type": "object"
          },
          "alerts": {
            "items": {
              "additionalProperties": true,
              "type": "object"
            },
            "title": "Alerts",
            "type": "array"
          },
          "dollars_budget": {
            "default": 0.0,
            "title": "Dollars Budget",
            "type": "number"
          },
          "dollars_used": {
            "default": 0.0,
            "title": "Dollars Used",
            "type": "number"
          },
          "investigation_id": {
            "format": "uuid",
            "title": "Investigation Id",
            "type": "string"
          },
          "lease_expires_at": {
            "format": "date-time",
            "title": "Lease Expires At",
            "type": "string"
          },
          "lease_id": {
            "format": "uuid",
            "title": "Lease Id",
            "type": "string"
          },
          "run_id": {
            "format": "uuid",
            "title": "Run Id",
            "type": "string"
          },
          "tokens_budget": {
            "title": "Tokens Budget",
            "type": "integer"
          },
          "tokens_used": {
            "title": "Tokens Used",
            "type": "integer"
          }
        },
        "required": [
          "run_id",
          "investigation_id",
          "tokens_used",
          "tokens_budget",
          "lease_id",
          "lease_expires_at",
          "alert"
        ],
        "title": "ClaimedRun",
        "type": "object"
      },
      "CompleteBody": {
        "properties": {
          "detail": {
            "additionalProperties": true,
            "title": "Detail",
            "type": "object"
          },
          "error_code": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Error Code"
          },
          "outcome": {
            "title": "Outcome",
            "type": "string"
          },
          "summary": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Summary"
          }
        },
        "required": [
          "outcome"
        ],
        "title": "CompleteBody",
        "type": "object"
      },
      "CompletePayload": {
        "properties": {
          "disposition": {
            "anyOf": [
              {
                "pattern": "^(close_fp|escalate|leave_open)$",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Disposition"
          },
          "dollars_used": {
            "anyOf": [
              {
                "minimum": 0.0,
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Dollars Used"
          },
          "enrichments": {
            "additionalProperties": true,
            "title": "Enrichments",
            "type": "object"
          },
          "findings": {
            "items": {
              "type": "string"
            },
            "title": "Findings",
            "type": "array"
          },
          "last_error": {
            "anyOf": [
              {
                "maxLength": 4096,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Last Error"
          },
          "lease_id": {
            "format": "uuid",
            "title": "Lease Id",
            "type": "string"
          },
          "status": {
            "pattern": "^(completed|halted_budget|failed)$",
            "title": "Status",
            "type": "string"
          },
          "tokens_used": {
            "minimum": 0.0,
            "title": "Tokens Used",
            "type": "integer"
          },
          "verdict_confidence": {
            "anyOf": [
              {
                "maximum": 1.0,
                "minimum": 0.0,
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Verdict Confidence"
          },
          "verdict_summary": {
            "anyOf": [
              {
                "maxLength": 1024,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Verdict Summary"
          }
        },
        "required": [
          "lease_id",
          "status",
          "tokens_used"
        ],
        "title": "CompletePayload",
        "type": "object"
      },
      "CustomerCaseDetail": {
        "description": "Customer-view projection \u2014 narrower than the MSSP CaseDetail.",
        "properties": {
          "closed_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Closed At"
          },
          "facts": {
            "$ref": "#/components/schemas/CustomerCaseFacts"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "opened_at": {
            "format": "date-time",
            "title": "Opened At",
            "type": "string"
          },
          "severity": {
            "title": "Severity",
            "type": "integer"
          },
          "short_id": {
            "title": "Short Id",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "summary": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Summary"
          },
          "title": {
            "title": "Title",
            "type": "string"
          }
        },
        "required": [
          "id",
          "short_id",
          "title",
          "status",
          "severity",
          "opened_at",
          "closed_at",
          "summary",
          "facts"
        ],
        "title": "CustomerCaseDetail",
        "type": "object"
      },
      "CustomerCaseFacts": {
        "description": "Customer-safe projection of investigation_facts.\n\nExplicitly omits MSSP-internal fields: hypotheses (internal\nreasoning), active_directives (MSSP policy), active_policies\n(MSSP configuration), and confidence scores. Only the timeline\nsummary survives, and only entries whose source is not MSSP-only.",
        "properties": {
          "timeline_summary": {
            "items": {
              "additionalProperties": true,
              "type": "object"
            },
            "title": "Timeline Summary",
            "type": "array"
          }
        },
        "title": "CustomerCaseFacts",
        "type": "object"
      },
      "CustomerCaseSummary": {
        "description": "Customer-view list row. Deliberately NOT a subclass of\n``CaseSummary`` \u2014 that shape includes ``assignee_user_id`` and\n``tenant_id``, which are MSSP-internal routing metadata that the\ncustomer portal should never see on the wire.",
        "properties": {
          "closed_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Closed At"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "opened_at": {
            "format": "date-time",
            "title": "Opened At",
            "type": "string"
          },
          "severity": {
            "title": "Severity",
            "type": "integer"
          },
          "short_id": {
            "title": "Short Id",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "title": {
            "title": "Title",
            "type": "string"
          }
        },
        "required": [
          "id",
          "short_id",
          "title",
          "status",
          "severity",
          "opened_at",
          "closed_at"
        ],
        "title": "CustomerCaseSummary",
        "type": "object"
      },
      "EventBody": {
        "properties": {
          "detail": {
            "additionalProperties": true,
            "title": "Detail",
            "type": "object"
          },
          "event_type": {
            "maxLength": 64,
            "title": "Event Type",
            "type": "string"
          },
          "seq": {
            "minimum": 1.0,
            "title": "Seq",
            "type": "integer"
          },
          "step": {
            "anyOf": [
              {
                "maxLength": 128,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Step"
          },
          "timestamp": {
            "format": "date-time",
            "title": "Timestamp",
            "type": "string"
          }
        },
        "required": [
          "seq",
          "event_type",
          "timestamp"
        ],
        "title": "EventBody",
        "type": "object"
      },
      "EventTimelineResponse": {
        "properties": {
          "events": {
            "items": {
              "$ref": "#/components/schemas/TimelineEvent"
            },
            "title": "Events",
            "type": "array"
          },
          "total": {
            "title": "Total",
            "type": "integer"
          }
        },
        "required": [
          "events",
          "total"
        ],
        "title": "EventTimelineResponse",
        "type": "object"
      },
      "ExternalSiemOnboard": {
        "description": "External SIEM (Wazuh) connection material for the ``provided`` profile.\n\nThe tenant brings their own Wazuh deployment rather than having SocTalk\nprovision one in-namespace. The Wazuh **API** (manager, :55000) and the\n**Indexer** (OpenSearch, :9200) authenticate with *separate* credentials,\nmirroring the 4-key ``*-wazuh-creds`` Secret. ``api_token`` is an optional\npre-minted manager token that overrides username/password auth; its\nabsence is always valid. Persisted onto the tenant's IntegrationConfig\n(passwords/token land in the ``*_plain`` columns).",
        "properties": {
          "api_password": {
            "maxLength": 4096,
            "title": "Api Password",
            "type": "string"
          },
          "api_token": {
            "anyOf": [
              {
                "maxLength": 4096,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Token"
          },
          "api_url": {
            "maxLength": 500,
            "title": "Api Url",
            "type": "string"
          },
          "api_username": {
            "maxLength": 255,
            "title": "Api Username",
            "type": "string"
          },
          "indexer_password": {
            "maxLength": 4096,
            "title": "Indexer Password",
            "type": "string"
          },
          "indexer_url": {
            "maxLength": 500,
            "title": "Indexer Url",
            "type": "string"
          },
          "indexer_username": {
            "maxLength": 255,
            "title": "Indexer Username",
            "type": "string"
          },
          "verify_ssl": {
            "default": true,
            "title": "Verify Ssl",
            "type": "boolean"
          }
        },
        "required": [
          "indexer_url",
          "indexer_username",
          "indexer_password",
          "api_url",
          "api_username",
          "api_password"
        ],
        "title": "ExternalSiemOnboard",
        "type": "object"
      },
      "ExternalSiemPatch": {
        "description": "All-optional external-SIEM credential patch.\n\nOnly non-None fields are written, so a caller can rotate a single\npassword (or flip ``verify_ssl``) without resending the full connection\nblock. ``None`` \u2014 not falsiness \u2014 is the \"leave unchanged\" sentinel, so\n``verify_ssl=False`` is a real write.",
        "properties": {
          "api_password": {
            "anyOf": [
              {
                "maxLength": 4096,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Password"
          },
          "api_token": {
            "anyOf": [
              {
                "maxLength": 4096,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Token"
          },
          "api_url": {
            "anyOf": [
              {
                "maxLength": 500,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Url"
          },
          "api_username": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Username"
          },
          "indexer_password": {
            "anyOf": [
              {
                "maxLength": 4096,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Indexer Password"
          },
          "indexer_url": {
            "anyOf": [
              {
                "maxLength": 500,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Indexer Url"
          },
          "indexer_username": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Indexer Username"
          },
          "verify_ssl": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Verify Ssl"
          }
        },
        "title": "ExternalSiemPatch",
        "type": "object"
      },
      "ExternalSiemRead": {
        "description": "Masked view of the external-SIEM config.\n\nPlaintext passwords/token are NEVER returned \u2014 only ``has_*`` booleans\nsignal their presence (mirrors the ``has_api_key`` precedent in\n``llm_config.LlmConfigRead``).",
        "properties": {
          "api_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Url"
          },
          "api_username": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Username"
          },
          "has_api_password": {
            "title": "Has Api Password",
            "type": "boolean"
          },
          "has_api_token": {
            "title": "Has Api Token",
            "type": "boolean"
          },
          "has_indexer_password": {
            "title": "Has Indexer Password",
            "type": "boolean"
          },
          "indexer_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Indexer Url"
          },
          "indexer_username": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Indexer Username"
          },
          "verify_ssl": {
            "title": "Verify Ssl",
            "type": "boolean"
          }
        },
        "required": [
          "indexer_url",
          "indexer_username",
          "api_url",
          "api_username",
          "has_indexer_password",
          "has_api_password",
          "has_api_token",
          "verify_ssl"
        ],
        "title": "ExternalSiemRead",
        "type": "object"
      },
      "FactsCorrectionRequest": {
        "properties": {
          "path": {
            "maxLength": 255,
            "minLength": 1,
            "title": "Path",
            "type": "string"
          },
          "value": {
            "title": "Value"
          }
        },
        "required": [
          "path",
          "value"
        ],
        "title": "FactsCorrectionRequest",
        "type": "object"
      },
      "HTTPValidationError": {
        "properties": {
          "detail": {
            "items": {
              "$ref": "#/components/schemas/ValidationError"
            },
            "title": "Detail",
            "type": "array"
          }
        },
        "title": "HTTPValidationError",
        "type": "object"
      },
      "HeartbeatBody": {
        "properties": {
          "agent_version": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Agent Version"
          },
          "reported_chart_version": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reported Chart Version"
          },
          "reported_state": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reported State"
          },
          "timestamp": {
            "format": "date-time",
            "title": "Timestamp",
            "type": "string"
          }
        },
        "required": [
          "timestamp"
        ],
        "title": "HeartbeatBody",
        "type": "object"
      },
      "HeatmapCell": {
        "properties": {
          "count": {
            "title": "Count",
            "type": "integer"
          },
          "dow": {
            "title": "Dow",
            "type": "integer"
          },
          "hour": {
            "title": "Hour",
            "type": "integer"
          }
        },
        "required": [
          "dow",
          "hour",
          "count"
        ],
        "title": "HeatmapCell",
        "type": "object"
      },
      "HeatmapResponse": {
        "properties": {
          "cells": {
            "items": {
              "$ref": "#/components/schemas/HeatmapCell"
            },
            "title": "Cells",
            "type": "array"
          },
          "days": {
            "title": "Days",
            "type": "integer"
          },
          "dimension": {
            "title": "Dimension",
            "type": "string"
          }
        },
        "required": [
          "dimension",
          "days",
          "cells"
        ],
        "title": "HeatmapResponse",
        "type": "object"
      },
      "HourlyMetric": {
        "properties": {
          "auto_closed": {
            "title": "Auto Closed",
            "type": "integer"
          },
          "avg_time_to_verdict_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Avg Time To Verdict Seconds"
          },
          "escalations": {
            "title": "Escalations",
            "type": "integer"
          },
          "hour": {
            "title": "Hour",
            "type": "string"
          },
          "investigations_closed": {
            "title": "Investigations Closed",
            "type": "integer"
          },
          "investigations_created": {
            "title": "Investigations Created",
            "type": "integer"
          },
          "malicious_observables": {
            "title": "Malicious Observables",
            "type": "integer"
          },
          "open_wip": {
            "title": "Open Wip",
            "type": "integer"
          },
          "total_alerts": {
            "title": "Total Alerts",
            "type": "integer"
          },
          "total_observables": {
            "title": "Total Observables",
            "type": "integer"
          }
        },
        "required": [
          "hour",
          "investigations_created",
          "investigations_closed",
          "escalations",
          "auto_closed",
          "avg_time_to_verdict_seconds",
          "total_alerts",
          "total_observables",
          "malicious_observables",
          "open_wip"
        ],
        "title": "HourlyMetric",
        "type": "object"
      },
      "HourlyMetricsResponse": {
        "properties": {
          "end": {
            "title": "End",
            "type": "string"
          },
          "metrics": {
            "items": {
              "$ref": "#/components/schemas/HourlyMetric"
            },
            "title": "Metrics",
            "type": "array"
          },
          "start": {
            "title": "Start",
            "type": "string"
          },
          "total_hours": {
            "title": "Total Hours",
            "type": "integer"
          }
        },
        "required": [
          "metrics",
          "start",
          "end",
          "total_hours"
        ],
        "title": "HourlyMetricsResponse",
        "type": "object"
      },
      "IngestBatch": {
        "properties": {
          "batch_seq": {
            "anyOf": [
              {
                "minimum": 0.0,
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Batch Seq"
          },
          "events": {
            "items": {
              "$ref": "#/components/schemas/AdapterEvent"
            },
            "maxItems": 500,
            "title": "Events",
            "type": "array"
          },
          "schema_version": {
            "default": 1,
            "minimum": 1.0,
            "title": "Schema Version",
            "type": "integer"
          },
          "tenant_id": {
            "format": "uuid",
            "title": "Tenant Id",
            "type": "string"
          }
        },
        "required": [
          "tenant_id",
          "events"
        ],
        "title": "IngestBatch",
        "type": "object"
      },
      "IngestedIOC": {
        "properties": {
          "type": {
            "maxLength": 32,
            "title": "Type",
            "type": "string"
          },
          "value": {
            "maxLength": 2048,
            "title": "Value",
            "type": "string"
          }
        },
        "required": [
          "type",
          "value"
        ],
        "title": "IngestedIOC",
        "type": "object"
      },
      "IntegrationsDTO": {
        "properties": {
          "auto_close_enabled": {
            "title": "Auto Close Enabled",
            "type": "boolean"
          },
          "misp_ingest_enabled": {
            "title": "Misp Ingest Enabled",
            "type": "boolean"
          },
          "misp_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Misp Url"
          },
          "thehive_export_enabled": {
            "title": "Thehive Export Enabled",
            "type": "boolean"
          },
          "thehive_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Thehive Url"
          }
        },
        "required": [
          "thehive_export_enabled",
          "thehive_url",
          "misp_ingest_enabled",
          "misp_url",
          "auto_close_enabled"
        ],
        "title": "IntegrationsDTO",
        "type": "object"
      },
      "IntegrationsPatch": {
        "properties": {
          "auto_close_enabled": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Auto Close Enabled"
          },
          "misp_ingest_enabled": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Misp Ingest Enabled"
          },
          "misp_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Misp Url"
          },
          "thehive_export_enabled": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Thehive Export Enabled"
          },
          "thehive_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Thehive Url"
          }
        },
        "title": "IntegrationsPatch",
        "type": "object"
      },
      "Investigation": {
        "properties": {
          "alert_count": {
            "title": "Alert Count",
            "type": "integer"
          },
          "clean_count": {
            "title": "Clean Count",
            "type": "integer"
          },
          "closed_at": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Closed At"
          },
          "created_at": {
            "title": "Created At",
            "type": "string"
          },
          "disposition": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Disposition"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "malicious_count": {
            "title": "Malicious Count",
            "type": "integer"
          },
          "max_severity": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Max Severity"
          },
          "observable_count": {
            "title": "Observable Count",
            "type": "integer"
          },
          "phase": {
            "title": "Phase",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "suspicious_count": {
            "title": "Suspicious Count",
            "type": "integer"
          },
          "tags": {
            "items": {
              "type": "string"
            },
            "title": "Tags",
            "type": "array"
          },
          "tenant_display_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Display Name"
          },
          "tenant_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Id"
          },
          "tenant_slug": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Slug"
          },
          "thehive_case_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Thehive Case Id"
          },
          "threat_actor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Threat Actor"
          },
          "time_to_triage_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Time To Triage Seconds"
          },
          "time_to_verdict_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Time To Verdict Seconds"
          },
          "title": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Title"
          },
          "tokens_budget": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tokens Budget"
          },
          "tokens_used": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tokens Used"
          },
          "updated_at": {
            "title": "Updated At",
            "type": "string"
          },
          "verdict_confidence": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Verdict Confidence"
          },
          "verdict_decision": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Verdict Decision"
          },
          "verdict_reasoning": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Verdict Reasoning"
          }
        },
        "required": [
          "id",
          "title",
          "status",
          "phase",
          "created_at",
          "updated_at",
          "closed_at",
          "alert_count",
          "observable_count",
          "malicious_count",
          "suspicious_count",
          "clean_count",
          "max_severity",
          "verdict_decision",
          "thehive_case_id",
          "time_to_triage_seconds",
          "time_to_verdict_seconds",
          "verdict_confidence",
          "verdict_reasoning",
          "threat_actor",
          "tags",
          "tokens_used",
          "tokens_budget",
          "disposition"
        ],
        "title": "Investigation",
        "type": "object"
      },
      "InvestigationList": {
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/InvestigationSummary"
            },
            "title": "Items",
            "type": "array"
          },
          "page": {
            "title": "Page",
            "type": "integer"
          },
          "page_size": {
            "title": "Page Size",
            "type": "integer"
          },
          "total": {
            "title": "Total",
            "type": "integer"
          }
        },
        "required": [
          "items",
          "total",
          "page",
          "page_size"
        ],
        "title": "InvestigationList",
        "type": "object"
      },
      "InvestigationSummary": {
        "properties": {
          "alert_count": {
            "title": "Alert Count",
            "type": "integer"
          },
          "clean_count": {
            "title": "Clean Count",
            "type": "integer"
          },
          "closed_at": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Closed At"
          },
          "created_at": {
            "title": "Created At",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "malicious_count": {
            "title": "Malicious Count",
            "type": "integer"
          },
          "max_severity": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Max Severity"
          },
          "observable_count": {
            "title": "Observable Count",
            "type": "integer"
          },
          "phase": {
            "title": "Phase",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "suspicious_count": {
            "title": "Suspicious Count",
            "type": "integer"
          },
          "tenant_display_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Display Name"
          },
          "tenant_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Id"
          },
          "tenant_slug": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Slug"
          },
          "thehive_case_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Thehive Case Id"
          },
          "title": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Title"
          },
          "updated_at": {
            "title": "Updated At",
            "type": "string"
          },
          "verdict_decision": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Verdict Decision"
          }
        },
        "required": [
          "id",
          "title",
          "status",
          "phase",
          "created_at",
          "updated_at",
          "closed_at",
          "alert_count",
          "observable_count",
          "malicious_count",
          "suspicious_count",
          "clean_count",
          "max_severity",
          "verdict_decision",
          "thehive_case_id"
        ],
        "title": "InvestigationSummary",
        "type": "object"
      },
      "LifecycleEventRead": {
        "properties": {
          "actor_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Actor Id"
          },
          "details": {
            "additionalProperties": true,
            "title": "Details",
            "type": "object"
          },
          "event_type": {
            "title": "Event Type",
            "type": "string"
          },
          "from_state": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "From State"
          },
          "id": {
            "format": "uuid",
            "title": "Id",
            "type": "string"
          },
          "timestamp": {
            "title": "Timestamp",
            "type": "string"
          },
          "to_state": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "To State"
          }
        },
        "required": [
          "id",
          "timestamp",
          "event_type",
          "from_state",
          "to_state",
          "actor_id",
          "details"
        ],
        "title": "LifecycleEventRead",
        "type": "object"
      },
      "LlmConfigRead": {
        "properties": {
          "api_key_preview": {
            "default": "",
            "title": "Api Key Preview",
            "type": "string"
          },
          "base_url": {
            "title": "Base Url",
            "type": "string"
          },
          "dollar_budget_per_run": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Dollar Budget Per Run"
          },
          "fast_model": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Fast Model"
          },
          "has_api_key": {
            "title": "Has Api Key",
            "type": "boolean"
          },
          "max_tokens": {
            "title": "Max Tokens",
            "type": "integer"
          },
          "model": {
            "title": "Model",
            "type": "string"
          },
          "provider": {
            "title": "Provider",
            "type": "string"
          },
          "reasoning_model": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reasoning Model"
          },
          "temperature": {
            "title": "Temperature",
            "type": "number"
          },
          "tiers": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tiers"
          },
          "token_budget_per_run": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Token Budget Per Run"
          }
        },
        "required": [
          "provider",
          "base_url",
          "model",
          "temperature",
          "max_tokens",
          "has_api_key"
        ],
        "title": "LlmConfigRead",
        "type": "object"
      },
      "LlmConfigUpdate": {
        "description": "Changed-fields-only PATCH payload.\n\n``fast_model`` / ``reasoning_model`` are tri-state:\n\n- ``None`` / omitted \u2192 leave the stored override unchanged;\n- empty or whitespace-only string \u2192 CLEAR the override to NULL\n  (revert to the ``llm_model`` fallback at render time);\n- any other value \u2192 set verbatim.\n\nThe empty-string-clears convention exists because the UI panel\nmust let an operator revert to \"use the primary model\" \u2014 ``None``\ncan't express that in a changed-fields-only PATCH.",
        "properties": {
          "api_key": {
            "anyOf": [
              {
                "maxLength": 4096,
                "minLength": 1,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Key"
          },
          "base_url": {
            "anyOf": [
              {
                "maxLength": 500,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Base Url"
          },
          "dollar_budget_per_run": {
            "anyOf": [
              {
                "maximum": 10000.0,
                "minimum": 0.1,
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Dollar Budget Per Run"
          },
          "fast_model": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Fast Model"
          },
          "max_tokens": {
            "anyOf": [
              {
                "maximum": 8192.0,
                "minimum": 1.0,
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Max Tokens"
          },
          "model": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Model"
          },
          "provider": {
            "anyOf": [
              {
                "pattern": "^(openai|anthropic|openai-compatible)$",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Provider"
          },
          "reasoning_model": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reasoning Model"
          },
          "temperature": {
            "anyOf": [
              {
                "maximum": 2.0,
                "minimum": 0.0,
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Temperature"
          },
          "tiers": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tiers"
          },
          "token_budget_per_run": {
            "anyOf": [
              {
                "maximum": 100000000.0,
                "minimum": 1000.0,
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Token Budget Per Run"
          }
        },
        "title": "LlmConfigUpdate",
        "type": "object"
      },
      "LoginRequest": {
        "properties": {
          "email": {
            "maxLength": 320,
            "title": "Email",
            "type": "string"
          },
          "password": {
            "maxLength": 4096,
            "minLength": 1,
            "title": "Password",
            "type": "string"
          },
          "tenant_slug": {
            "anyOf": [
              {
                "maxLength": 64,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Slug"
          }
        },
        "required": [
          "email",
          "password"
        ],
        "title": "LoginRequest",
        "type": "object"
      },
      "LoginResponse": {
        "properties": {
          "must_change": {
            "title": "Must Change",
            "type": "boolean"
          },
          "user": {
            "$ref": "#/components/schemas/UserPayload"
          }
        },
        "required": [
          "user",
          "must_change"
        ],
        "title": "LoginResponse",
        "type": "object"
      },
      "MetricsOverview": {
        "properties": {
          "auto_closed_today": {
            "title": "Auto Closed Today",
            "type": "integer"
          },
          "avg_time_to_triage_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Avg Time To Triage Seconds"
          },
          "avg_time_to_verdict_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Avg Time To Verdict Seconds"
          },
          "escalations_today": {
            "title": "Escalations Today",
            "type": "integer"
          },
          "investigations_closed_today": {
            "title": "Investigations Closed Today",
            "type": "integer"
          },
          "investigations_created_today": {
            "title": "Investigations Created Today",
            "type": "integer"
          },
          "malicious_observables_today": {
            "title": "Malicious Observables Today",
            "type": "integer"
          },
          "open_investigations": {
            "title": "Open Investigations",
            "type": "integer"
          },
          "pending_reviews": {
            "title": "Pending Reviews",
            "type": "integer"
          },
          "severity_breakdown": {
            "additionalProperties": {
              "type": "integer"
            },
            "title": "Severity Breakdown",
            "type": "object"
          },
          "total_alerts_today": {
            "title": "Total Alerts Today",
            "type": "integer"
          },
          "total_observables_today": {
            "title": "Total Observables Today",
            "type": "integer"
          },
          "verdict_breakdown": {
            "additionalProperties": {
              "type": "integer"
            },
            "title": "Verdict Breakdown",
            "type": "object"
          }
        },
        "required": [
          "open_investigations",
          "pending_reviews",
          "investigations_created_today",
          "investigations_closed_today",
          "escalations_today",
          "auto_closed_today",
          "avg_time_to_triage_seconds",
          "avg_time_to_verdict_seconds",
          "total_alerts_today",
          "total_observables_today",
          "malicious_observables_today",
          "severity_breakdown",
          "verdict_breakdown"
        ],
        "title": "MetricsOverview",
        "type": "object"
      },
      "OpenByTenantResponse": {
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/OpenByTenantRow"
            },
            "title": "Items",
            "type": "array"
          }
        },
        "required": [
          "items"
        ],
        "title": "OpenByTenantResponse",
        "type": "object"
      },
      "OpenByTenantRow": {
        "properties": {
          "display_name": {
            "title": "Display Name",
            "type": "string"
          },
          "max_severity": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Max Severity"
          },
          "oldest_opened_at": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Oldest Opened At"
          },
          "open_count": {
            "title": "Open Count",
            "type": "integer"
          },
          "slug": {
            "title": "Slug",
            "type": "string"
          },
          "tenant_id": {
            "title": "Tenant Id",
            "type": "string"
          }
        },
        "required": [
          "tenant_id",
          "slug",
          "display_name",
          "open_count",
          "oldest_opened_at",
          "max_severity"
        ],
        "title": "OpenByTenantRow",
        "type": "object"
      },
      "PasswordChangeRequest": {
        "properties": {
          "new_password": {
            "maxLength": 4096,
            "minLength": 1,
            "title": "New Password",
            "type": "string"
          },
          "old_password": {
            "maxLength": 4096,
            "minLength": 1,
            "title": "Old Password",
            "type": "string"
          }
        },
        "required": [
          "old_password",
          "new_password"
        ],
        "title": "PasswordChangeRequest",
        "type": "object"
      },
      "PendingReviewRow": {
        "properties": {
          "count": {
            "title": "Count",
            "type": "integer"
          },
          "display_name": {
            "title": "Display Name",
            "type": "string"
          },
          "slug": {
            "title": "Slug",
            "type": "string"
          },
          "tenant_id": {
            "title": "Tenant Id",
            "type": "string"
          }
        },
        "required": [
          "tenant_id",
          "slug",
          "display_name",
          "count"
        ],
        "title": "PendingReviewRow",
        "type": "object"
      },
      "PendingReviewsResponse": {
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/PendingReviewRow"
            },
            "title": "Items",
            "type": "array"
          }
        },
        "required": [
          "items"
        ],
        "title": "PendingReviewsResponse",
        "type": "object"
      },
      "ProposalDTO": {
        "properties": {
          "action_type": {
            "title": "Action Type",
            "type": "string"
          },
          "blast_radius": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Blast Radius"
          },
          "capability_class": {
            "title": "Capability Class",
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "investigation_id": {
            "title": "Investigation Id",
            "type": "string"
          },
          "params": {
            "additionalProperties": true,
            "title": "Params",
            "type": "object"
          },
          "rationale": {
            "title": "Rationale",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          }
        },
        "required": [
          "id",
          "investigation_id",
          "action_type",
          "params",
          "rationale",
          "blast_radius",
          "capability_class",
          "status",
          "created_at"
        ],
        "title": "ProposalDTO",
        "type": "object"
      },
      "ProposalDecisionRequest": {
        "properties": {
          "reason": {
            "maxLength": 2000,
            "minLength": 1,
            "title": "Reason",
            "type": "string"
          }
        },
        "required": [
          "reason"
        ],
        "title": "ProposalDecisionRequest",
        "type": "object"
      },
      "ProvisioningJobRead": {
        "properties": {
          "attempts": {
            "title": "Attempts",
            "type": "integer"
          },
          "id": {
            "format": "uuid",
            "title": "Id",
            "type": "string"
          },
          "kind": {
            "title": "Kind",
            "type": "string"
          },
          "last_error": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Last Error"
          },
          "max_attempts": {
            "title": "Max Attempts",
            "type": "integer"
          },
          "next_attempt_at": {
            "title": "Next Attempt At",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "tenant_id": {
            "format": "uuid",
            "title": "Tenant Id",
            "type": "string"
          }
        },
        "required": [
          "id",
          "tenant_id",
          "kind",
          "status",
          "attempts",
          "max_attempts",
          "last_error",
          "next_attempt_at"
        ],
        "title": "ProvisioningJobRead",
        "type": "object"
      },
      "PublicBranding": {
        "properties": {
          "app_name": {
            "title": "App Name",
            "type": "string"
          },
          "favicon_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Favicon Url"
          },
          "logo_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Logo Url"
          },
          "primary_color": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Primary Color"
          },
          "secondary_color": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Secondary Color"
          }
        },
        "required": [
          "app_name"
        ],
        "title": "PublicBranding",
        "type": "object"
      },
      "PublicMssp": {
        "properties": {
          "branding": {
            "$ref": "#/components/schemas/PublicBranding"
          },
          "display_name": {
            "title": "Display Name",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "slug": {
            "title": "Slug",
            "type": "string"
          }
        },
        "required": [
          "id",
          "slug",
          "display_name",
          "branding"
        ],
        "title": "PublicMssp",
        "type": "object"
      },
      "PublicScope": {
        "properties": {
          "branding": {
            "$ref": "#/components/schemas/PublicBranding"
          },
          "display_name": {
            "title": "Display Name",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "kind": {
            "title": "Kind",
            "type": "string"
          },
          "slug": {
            "title": "Slug",
            "type": "string"
          },
          "state": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "State"
          }
        },
        "required": [
          "kind",
          "id",
          "slug",
          "display_name",
          "branding"
        ],
        "title": "PublicScope",
        "type": "object"
      },
      "PublicTenant": {
        "properties": {
          "branding": {
            "$ref": "#/components/schemas/PublicBranding"
          },
          "display_name": {
            "title": "Display Name",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "slug": {
            "title": "Slug",
            "type": "string"
          },
          "state": {
            "title": "State",
            "type": "string"
          }
        },
        "required": [
          "id",
          "slug",
          "display_name",
          "state",
          "branding"
        ],
        "title": "PublicTenant",
        "type": "object"
      },
      "RankingResponse": {
        "properties": {
          "days": {
            "title": "Days",
            "type": "integer"
          },
          "fleet_median_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Fleet Median Seconds"
          },
          "metric": {
            "title": "Metric",
            "type": "string"
          },
          "min_sample": {
            "title": "Min Sample",
            "type": "integer"
          },
          "rows": {
            "items": {
              "$ref": "#/components/schemas/RankingRow"
            },
            "title": "Rows",
            "type": "array"
          }
        },
        "required": [
          "metric",
          "days",
          "min_sample",
          "fleet_median_seconds",
          "rows"
        ],
        "title": "RankingResponse",
        "type": "object"
      },
      "RankingRow": {
        "properties": {
          "current_p95_seconds": {
            "title": "Current P95 Seconds",
            "type": "number"
          },
          "delta_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Delta Seconds"
          },
          "display_name": {
            "title": "Display Name",
            "type": "string"
          },
          "previous_p95_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Previous P95 Seconds"
          },
          "sample_current": {
            "title": "Sample Current",
            "type": "integer"
          },
          "sample_previous": {
            "title": "Sample Previous",
            "type": "integer"
          },
          "slug": {
            "title": "Slug",
            "type": "string"
          },
          "tenant_id": {
            "title": "Tenant Id",
            "type": "string"
          }
        },
        "required": [
          "tenant_id",
          "slug",
          "display_name",
          "current_p95_seconds",
          "previous_p95_seconds",
          "delta_seconds",
          "sample_current",
          "sample_previous"
        ],
        "title": "RankingRow",
        "type": "object"
      },
      "RegisterBody": {
        "properties": {
          "agent_version": {
            "maxLength": 64,
            "title": "Agent Version",
            "type": "string"
          },
          "cluster_label": {
            "maxLength": 128,
            "title": "Cluster Label",
            "type": "string"
          },
          "kubernetes_version": {
            "anyOf": [
              {
                "maxLength": 64,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Kubernetes Version"
          },
          "node_count": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Node Count"
          }
        },
        "required": [
          "cluster_label",
          "agent_version"
        ],
        "title": "RegisterBody",
        "type": "object"
      },
      "RegisterResponse": {
        "properties": {
          "claim_max_wait_seconds": {
            "title": "Claim Max Wait Seconds",
            "type": "integer"
          },
          "heartbeat_interval_seconds": {
            "title": "Heartbeat Interval Seconds",
            "type": "integer"
          },
          "installation_id": {
            "title": "Installation Id",
            "type": "string"
          },
          "runtime_token": {
            "title": "Runtime Token",
            "type": "string"
          }
        },
        "required": [
          "installation_id",
          "runtime_token",
          "heartbeat_interval_seconds",
          "claim_max_wait_seconds"
        ],
        "title": "RegisterResponse",
        "type": "object"
      },
      "RepeatedIocRow": {
        "properties": {
          "first_seen": {
            "title": "First Seen",
            "type": "string"
          },
          "ioc_type": {
            "title": "Ioc Type",
            "type": "string"
          },
          "ioc_value": {
            "title": "Ioc Value",
            "type": "string"
          },
          "last_seen": {
            "title": "Last Seen",
            "type": "string"
          },
          "max_severity": {
            "title": "Max Severity",
            "type": "integer"
          },
          "tenant_count": {
            "title": "Tenant Count",
            "type": "integer"
          },
          "tenants": {
            "items": {
              "$ref": "#/components/schemas/RepeatedIocTenantRef"
            },
            "title": "Tenants",
            "type": "array"
          }
        },
        "required": [
          "ioc_type",
          "ioc_value",
          "tenant_count",
          "tenants",
          "first_seen",
          "last_seen",
          "max_severity"
        ],
        "title": "RepeatedIocRow",
        "type": "object"
      },
      "RepeatedIocTenantRef": {
        "properties": {
          "display_name": {
            "title": "Display Name",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "slug": {
            "title": "Slug",
            "type": "string"
          }
        },
        "required": [
          "id",
          "slug",
          "display_name"
        ],
        "title": "RepeatedIocTenantRef",
        "type": "object"
      },
      "RepeatedIocsResponse": {
        "properties": {
          "days": {
            "title": "Days",
            "type": "integer"
          },
          "items": {
            "items": {
              "$ref": "#/components/schemas/RepeatedIocRow"
            },
            "title": "Items",
            "type": "array"
          },
          "threshold": {
            "title": "Threshold",
            "type": "integer"
          }
        },
        "required": [
          "items",
          "days",
          "threshold"
        ],
        "title": "RepeatedIocsResponse",
        "type": "object"
      },
      "RetryInstallResponse": {
        "properties": {
          "installation_id": {
            "title": "Installation Id",
            "type": "string"
          },
          "reclaimed": {
            "title": "Reclaimed",
            "type": "integer"
          },
          "reset_to_pending": {
            "title": "Reset To Pending",
            "type": "integer"
          },
          "state": {
            "title": "State",
            "type": "string"
          }
        },
        "required": [
          "installation_id",
          "state",
          "reclaimed",
          "reset_to_pending"
        ],
        "title": "RetryInstallResponse",
        "type": "object"
      },
      "StuckCaseRow": {
        "properties": {
          "display_name": {
            "title": "Display Name",
            "type": "string"
          },
          "investigation_id": {
            "title": "Investigation Id",
            "type": "string"
          },
          "last_activity_at": {
            "title": "Last Activity At",
            "type": "string"
          },
          "opened_at": {
            "title": "Opened At",
            "type": "string"
          },
          "severity": {
            "title": "Severity",
            "type": "integer"
          },
          "slug": {
            "title": "Slug",
            "type": "string"
          },
          "stuck_for_seconds": {
            "title": "Stuck For Seconds",
            "type": "integer"
          },
          "tenant_id": {
            "title": "Tenant Id",
            "type": "string"
          }
        },
        "required": [
          "investigation_id",
          "tenant_id",
          "slug",
          "display_name",
          "opened_at",
          "last_activity_at",
          "severity",
          "stuck_for_seconds"
        ],
        "title": "StuckCaseRow",
        "type": "object"
      },
      "StuckInvestigationsResponse": {
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/StuckCaseRow"
            },
            "title": "Items",
            "type": "array"
          }
        },
        "required": [
          "items"
        ],
        "title": "StuckInvestigationsResponse",
        "type": "object"
      },
      "TenantCreate": {
        "properties": {
          "branding_app_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Branding App Name"
          },
          "branding_logo_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Branding Logo Url"
          },
          "branding_primary_color": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Branding Primary Color"
          },
          "branding_secondary_color": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Branding Secondary Color"
          },
          "cortex_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Cortex Url"
          },
          "display_name": {
            "maxLength": 255,
            "minLength": 1,
            "title": "Display Name",
            "type": "string"
          },
          "llm_base_url": {
            "default": "https://api.openai.com/v1",
            "title": "Llm Base Url",
            "type": "string"
          },
          "llm_model": {
            "default": "gpt-4o",
            "title": "Llm Model",
            "type": "string"
          },
          "slug": {
            "maxLength": 63,
            "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
            "title": "Slug",
            "type": "string"
          },
          "thehive_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Thehive Url"
          },
          "wazuh_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Wazuh Url"
          }
        },
        "required": [
          "slug",
          "display_name"
        ],
        "title": "TenantCreate",
        "type": "object"
      },
      "TenantHealthResponse": {
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/TenantHealthRow"
            },
            "title": "Items",
            "type": "array"
          }
        },
        "required": [
          "items"
        ],
        "title": "TenantHealthResponse",
        "type": "object"
      },
      "TenantHealthRow": {
        "properties": {
          "display_name": {
            "title": "Display Name",
            "type": "string"
          },
          "heartbeat_age_seconds": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Heartbeat Age Seconds"
          },
          "last_heartbeat": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Last Heartbeat"
          },
          "slug": {
            "title": "Slug",
            "type": "string"
          },
          "state": {
            "title": "State",
            "type": "string"
          },
          "tenant_id": {
            "title": "Tenant Id",
            "type": "string"
          },
          "unhealthy": {
            "title": "Unhealthy",
            "type": "boolean"
          }
        },
        "required": [
          "tenant_id",
          "slug",
          "display_name",
          "state",
          "last_heartbeat",
          "heartbeat_age_seconds",
          "unhealthy"
        ],
        "title": "TenantHealthRow",
        "type": "object"
      },
      "TenantLlmKeyUpdate": {
        "description": "Tenant-pasted API key payload.\n\nProvider/model are MSSP-controlled \u2014 the tenant can't switch from\nAnthropic to OpenAI on a whim because the install's outbound-\negress allowlist (Cilium policy in render.py) only permits the\nconfigured provider's hostname. They can only swap the credential.",
        "properties": {
          "api_key": {
            "maxLength": 4096,
            "minLength": 1,
            "title": "Api Key",
            "type": "string"
          }
        },
        "required": [
          "api_key"
        ],
        "title": "TenantLlmKeyUpdate",
        "type": "object"
      },
      "TenantOnboard": {
        "description": "Wizard payload \u2014 one POST, three logical steps' worth of data.",
        "properties": {
          "branding_app_name": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Branding App Name"
          },
          "branding_logo_url": {
            "anyOf": [
              {
                "maxLength": 500,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Branding Logo Url"
          },
          "branding_primary_color": {
            "anyOf": [
              {
                "maxLength": 16,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Branding Primary Color"
          },
          "branding_secondary_color": {
            "anyOf": [
              {
                "maxLength": 16,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Branding Secondary Color"
          },
          "contact_email": {
            "anyOf": [
              {
                "maxLength": 320,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Contact Email"
          },
          "display_name": {
            "maxLength": 255,
            "minLength": 1,
            "title": "Display Name",
            "type": "string"
          },
          "external_siem": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/ExternalSiemOnboard"
              },
              {
                "type": "null"
              }
            ]
          },
          "llm_api_key": {
            "anyOf": [
              {
                "maxLength": 4096,
                "minLength": 1,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Api Key"
          },
          "llm_base_url": {
            "default": "https://api.openai.com/v1",
            "title": "Llm Base Url",
            "type": "string"
          },
          "llm_fast_model": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Fast Model"
          },
          "llm_model": {
            "default": "gpt-4o",
            "title": "Llm Model",
            "type": "string"
          },
          "llm_provider": {
            "anyOf": [
              {
                "pattern": "^(openai|anthropic|openai-compatible)$",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Provider"
          },
          "llm_reasoning_model": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Reasoning Model"
          },
          "profile": {
            "pattern": "^(poc|persistent|provided)$",
            "title": "Profile",
            "type": "string"
          },
          "slug": {
            "maxLength": 63,
            "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
            "title": "Slug",
            "type": "string"
          }
        },
        "required": [
          "slug",
          "display_name",
          "profile"
        ],
        "title": "TenantOnboard",
        "type": "object"
      },
      "TenantRead": {
        "properties": {
          "created_at": {
            "title": "Created At",
            "type": "string"
          },
          "display_name": {
            "title": "Display Name",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "title": "Id",
            "type": "string"
          },
          "profile": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Profile"
          },
          "runtime": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Runtime"
          },
          "slug": {
            "title": "Slug",
            "type": "string"
          },
          "state": {
            "title": "State",
            "type": "string"
          },
          "state_changed_at": {
            "title": "State Changed At",
            "type": "string"
          }
        },
        "required": [
          "id",
          "slug",
          "display_name",
          "state",
          "created_at",
          "state_changed_at"
        ],
        "title": "TenantRead",
        "type": "object"
      },
      "TimelineEvent": {
        "properties": {
          "data": {
            "additionalProperties": true,
            "title": "Data",
            "type": "object"
          },
          "event_type": {
            "title": "Event Type",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "investigation_id": {
            "title": "Investigation Id",
            "type": "string"
          },
          "timestamp": {
            "title": "Timestamp",
            "type": "string"
          }
        },
        "required": [
          "id",
          "investigation_id",
          "event_type",
          "timestamp",
          "data"
        ],
        "title": "TimelineEvent",
        "type": "object"
      },
      "TrendBucket": {
        "properties": {
          "alert_count": {
            "title": "Alert Count",
            "type": "integer"
          },
          "bucket": {
            "title": "Bucket",
            "type": "string"
          },
          "closed_count": {
            "title": "Closed Count",
            "type": "integer"
          },
          "escalated_count": {
            "title": "Escalated Count",
            "type": "integer"
          },
          "p95_ttr_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "P95 Ttr Seconds"
          },
          "p95_ttv_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "P95 Ttv Seconds"
          }
        },
        "required": [
          "bucket",
          "alert_count",
          "closed_count",
          "escalated_count",
          "p95_ttv_seconds",
          "p95_ttr_seconds"
        ],
        "title": "TrendBucket",
        "type": "object"
      },
      "TrendsResponse": {
        "properties": {
          "bucket_size": {
            "title": "Bucket Size",
            "type": "string"
          },
          "buckets": {
            "items": {
              "$ref": "#/components/schemas/TrendBucket"
            },
            "title": "Buckets",
            "type": "array"
          },
          "days": {
            "title": "Days",
            "type": "integer"
          },
          "window_alert_total": {
            "title": "Window Alert Total",
            "type": "integer"
          },
          "window_closed_total": {
            "title": "Window Closed Total",
            "type": "integer"
          },
          "window_escalated_total": {
            "title": "Window Escalated Total",
            "type": "integer"
          },
          "window_p95_ttr_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Window P95 Ttr Seconds"
          },
          "window_p95_ttv_seconds": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Window P95 Ttv Seconds"
          }
        },
        "required": [
          "days",
          "bucket_size",
          "buckets",
          "window_p95_ttv_seconds",
          "window_p95_ttr_seconds",
          "window_alert_total",
          "window_closed_total",
          "window_escalated_total"
        ],
        "title": "TrendsResponse",
        "type": "object"
      },
      "UserPayload": {
        "properties": {
          "current_tenant": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Current Tenant"
          },
          "current_tenant_display_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Current Tenant Display Name"
          },
          "current_tenant_slug": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Current Tenant Slug"
          },
          "email": {
            "title": "Email",
            "type": "string"
          },
          "role": {
            "title": "Role",
            "type": "string"
          },
          "tenant_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Id"
          },
          "user_id": {
            "title": "User Id",
            "type": "string"
          },
          "user_type": {
            "title": "User Type",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "email",
          "user_type",
          "role",
          "tenant_id",
          "current_tenant"
        ],
        "title": "UserPayload",
        "type": "object"
      },
      "ValidationError": {
        "properties": {
          "ctx": {
            "title": "Context",
            "type": "object"
          },
          "input": {
            "title": "Input"
          },
          "loc": {
            "items": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "integer"
                }
              ]
            },
            "title": "Location",
            "type": "array"
          },
          "msg": {
            "title": "Message",
            "type": "string"
          },
          "type": {
            "title": "Error Type",
            "type": "string"
          }
        },
        "required": [
          "loc",
          "msg",
          "type"
        ],
        "title": "ValidationError",
        "type": "object"
      },
      "WireEntity": {
        "description": "A typed, role-carrying entity the decoder already parsed.\n\n``source_field`` preserves provenance to the decoded field (e.g.\n``data.srcuser``) so any downstream conclusion can be traced back.",
        "properties": {
          "role": {
            "anyOf": [
              {
                "enum": [
                  "actor",
                  "target",
                  "src",
                  "dst",
                  "parent"
                ],
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Role"
          },
          "source_field": {
            "anyOf": [
              {
                "maxLength": 128,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Source Field"
          },
          "type": {
            "enum": [
              "user",
              "host",
              "ip",
              "process",
              "hash",
              "domain",
              "port"
            ],
            "title": "Type",
            "type": "string"
          },
          "value": {
            "maxLength": 512,
            "title": "Value",
            "type": "string"
          }
        },
        "required": [
          "type",
          "value"
        ],
        "title": "WireEntity",
        "type": "object"
      },
      "WireMitre": {
        "description": "MITRE ATT&CK references carried on the rule (size-capped).",
        "properties": {
          "ids": {
            "items": {
              "type": "string"
            },
            "maxItems": 16,
            "title": "Ids",
            "type": "array"
          },
          "tactics": {
            "items": {
              "type": "string"
            },
            "maxItems": 16,
            "title": "Tactics",
            "type": "array"
          },
          "techniques": {
            "items": {
              "type": "string"
            },
            "maxItems": 16,
            "title": "Techniques",
            "type": "array"
          }
        },
        "title": "WireMitre",
        "type": "object"
      },
      "WorkerHeartbeatPayload": {
        "properties": {
          "dollars_used": {
            "anyOf": [
              {
                "minimum": 0.0,
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Dollars Used"
          },
          "lease_id": {
            "format": "uuid",
            "title": "Lease Id",
            "type": "string"
          },
          "tokens_used": {
            "minimum": 0.0,
            "title": "Tokens Used",
            "type": "integer"
          }
        },
        "required": [
          "lease_id",
          "tokens_used"
        ],
        "title": "WorkerHeartbeatPayload",
        "type": "object"
      },
      "_ApproveBody": {
        "properties": {
          "feedback": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Feedback"
          }
        },
        "title": "_ApproveBody",
        "type": "object"
      },
      "_ConversationDetailOut": {
        "properties": {
          "conversation": {
            "$ref": "#/components/schemas/_ConversationOut"
          },
          "messages": {
            "items": {
              "$ref": "#/components/schemas/_MessageOut"
            },
            "title": "Messages",
            "type": "array"
          }
        },
        "required": [
          "conversation",
          "messages"
        ],
        "title": "_ConversationDetailOut",
        "type": "object"
      },
      "_ConversationListOut": {
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/_ConversationOut"
            },
            "title": "Items",
            "type": "array"
          }
        },
        "required": [
          "items"
        ],
        "title": "_ConversationListOut",
        "type": "object"
      },
      "_ConversationOut": {
        "properties": {
          "budget_dollars": {
            "title": "Budget Dollars",
            "type": "number"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "created_by_user_id": {
            "title": "Created By User Id",
            "type": "string"
          },
          "focused_tenant_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Focused Tenant Id"
          },
          "focused_tenant_slug": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Focused Tenant Slug"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "investigation_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Investigation Id"
          },
          "last_message_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Last Message At"
          },
          "model_name": {
            "title": "Model Name",
            "type": "string"
          },
          "scope": {
            "title": "Scope",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "tenant_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Id"
          },
          "title": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Title"
          },
          "total_dollars": {
            "title": "Total Dollars",
            "type": "number"
          },
          "total_tokens": {
            "title": "Total Tokens",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "tenant_id",
          "scope",
          "focused_tenant_id",
          "focused_tenant_slug",
          "created_by_user_id",
          "investigation_id",
          "title",
          "model_name",
          "status",
          "total_tokens",
          "total_dollars",
          "budget_dollars",
          "created_at",
          "last_message_at"
        ],
        "title": "_ConversationOut",
        "type": "object"
      },
      "_CreateConversationBody": {
        "properties": {
          "investigation_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Investigation Id"
          },
          "model": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Model"
          },
          "scope": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Scope"
          }
        },
        "title": "_CreateConversationBody",
        "type": "object"
      },
      "_ExpireBody": {
        "properties": {
          "reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reason"
          }
        },
        "title": "_ExpireBody",
        "type": "object"
      },
      "_MessageOut": {
        "properties": {
          "content": {
            "additionalProperties": true,
            "title": "Content",
            "type": "object"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "dollars": {
            "title": "Dollars",
            "type": "number"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "role": {
            "title": "Role",
            "type": "string"
          },
          "tokens_in": {
            "title": "Tokens In",
            "type": "integer"
          },
          "tokens_out": {
            "title": "Tokens Out",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "role",
          "content",
          "tokens_in",
          "tokens_out",
          "dollars",
          "created_at"
        ],
        "title": "_MessageOut",
        "type": "object"
      },
      "_PendingReviewItem": {
        "properties": {
          "ai_assessment": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ai Assessment"
          },
          "ai_confidence": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ai Confidence"
          },
          "ai_decision": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ai Decision"
          },
          "ai_recommendation": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ai Recommendation"
          },
          "alert_count": {
            "title": "Alert Count",
            "type": "integer"
          },
          "clean_count": {
            "default": 0,
            "title": "Clean Count",
            "type": "integer"
          },
          "created_at": {
            "title": "Created At",
            "type": "string"
          },
          "description": {
            "title": "Description",
            "type": "string"
          },
          "enrichments": {
            "additionalProperties": true,
            "default": {},
            "title": "Enrichments",
            "type": "object"
          },
          "expires_at": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Expires At"
          },
          "findings": {
            "default": [],
            "items": {
              "type": "string"
            },
            "title": "Findings",
            "type": "array"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "investigation_id": {
            "title": "Investigation Id",
            "type": "string"
          },
          "malicious_count": {
            "default": 0,
            "title": "Malicious Count",
            "type": "integer"
          },
          "max_severity": {
            "title": "Max Severity",
            "type": "string"
          },
          "misp_context": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Misp Context"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "suspicious_count": {
            "default": 0,
            "title": "Suspicious Count",
            "type": "integer"
          },
          "timeout_seconds": {
            "default": 3600,
            "title": "Timeout Seconds",
            "type": "integer"
          },
          "title": {
            "title": "Title",
            "type": "string"
          }
        },
        "required": [
          "id",
          "investigation_id",
          "status",
          "title",
          "description",
          "max_severity",
          "alert_count",
          "created_at"
        ],
        "title": "_PendingReviewItem",
        "type": "object"
      },
      "_PendingReviewList": {
        "properties": {
          "has_more": {
            "default": false,
            "title": "Has More",
            "type": "boolean"
          },
          "items": {
            "default": [],
            "items": {
              "$ref": "#/components/schemas/_PendingReviewItem"
            },
            "title": "Items",
            "type": "array"
          },
          "page": {
            "default": 1,
            "title": "Page",
            "type": "integer"
          },
          "page_size": {
            "default": 50,
            "title": "Page Size",
            "type": "integer"
          },
          "total": {
            "default": 0,
            "title": "Total",
            "type": "integer"
          }
        },
        "title": "_PendingReviewList",
        "type": "object"
      },
      "_PostMessageBody": {
        "properties": {
          "text": {
            "maxLength": 4000,
            "minLength": 1,
            "title": "Text",
            "type": "string"
          }
        },
        "required": [
          "text"
        ],
        "title": "_PostMessageBody",
        "type": "object"
      },
      "_RequestInfoBody": {
        "properties": {
          "questions": {
            "default": [],
            "items": {
              "type": "string"
            },
            "title": "Questions",
            "type": "array"
          }
        },
        "title": "_RequestInfoBody",
        "type": "object"
      },
      "_ReviewActionResponse": {
        "properties": {
          "investigation_id": {
            "title": "Investigation Id",
            "type": "string"
          },
          "new_status": {
            "title": "New Status",
            "type": "string"
          },
          "review_id": {
            "title": "Review Id",
            "type": "string"
          },
          "success": {
            "default": true,
            "title": "Success",
            "type": "boolean"
          }
        },
        "required": [
          "review_id",
          "new_status",
          "investigation_id"
        ],
        "title": "_ReviewActionResponse",
        "type": "object"
      }
    }
  },
  "info": {
    "description": "MSSP-deployed SOC control plane. See docs/multi-tenant/ for architecture.",
    "title": "SocTalk V1",
    "version": "0.1.0"
  },
  "openapi": "3.1.0",
  "paths": {
    "/api/agent/heartbeat": {
      "post": {
        "operationId": "heartbeat_api_agent_heartbeat_post",
        "parameters": [
          {
            "in": "header",
            "name": "authorization",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Authorization"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/HeartbeatBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Heartbeat",
        "tags": [
          "l2-agent"
        ],
        "x-soctalk-auth": "L2 agent install token (bearer)"
      }
    },
    "/api/agent/jobs/{job_id}/complete": {
      "post": {
        "operationId": "complete_job_api_agent_jobs__job_id__complete_post",
        "parameters": [
          {
            "in": "path",
            "name": "job_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Job Id",
              "type": "string"
            }
          },
          {
            "in": "header",
            "name": "authorization",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Authorization"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CompleteBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Complete Job",
        "tags": [
          "l2-agent"
        ],
        "x-soctalk-auth": "L2 agent install token (bearer)"
      }
    },
    "/api/agent/jobs/{job_id}/events": {
      "post": {
        "operationId": "post_event_api_agent_jobs__job_id__events_post",
        "parameters": [
          {
            "in": "path",
            "name": "job_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Job Id",
              "type": "string"
            }
          },
          {
            "in": "header",
            "name": "authorization",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Authorization"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/EventBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Post Event",
        "tags": [
          "l2-agent"
        ],
        "x-soctalk-auth": "L2 agent install token (bearer)"
      }
    },
    "/api/agent/jobs:claim": {
      "post": {
        "operationId": "claim_job_api_agent_jobs_claim_post",
        "parameters": [
          {
            "in": "query",
            "name": "wait",
            "required": false,
            "schema": {
              "default": 30,
              "title": "Wait",
              "type": "integer"
            }
          },
          {
            "in": "header",
            "name": "authorization",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Authorization"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Claim Job",
        "tags": [
          "l2-agent"
        ],
        "x-soctalk-auth": "L2 agent install token (bearer)"
      }
    },
    "/api/agent/register": {
      "post": {
        "operationId": "register_api_agent_register_post",
        "parameters": [
          {
            "in": "header",
            "name": "authorization",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Authorization"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RegisterBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RegisterResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Register",
        "tags": [
          "l2-agent"
        ],
        "x-soctalk-auth": "L2 agent install token (bearer)"
      }
    },
    "/api/analytics/ai-behavior": {
      "get": {
        "operationId": "analytics_ai_behavior_api_analytics_ai_behavior_get",
        "parameters": [
          {
            "in": "query",
            "name": "days",
            "required": false,
            "schema": {
              "default": 7,
              "maximum": 90,
              "minimum": 1,
              "title": "Days",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Analytics Ai Behavior Api Analytics Ai Behavior Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Analytics Ai Behavior",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/analytics/human-review": {
      "get": {
        "operationId": "analytics_human_review_api_analytics_human_review_get",
        "parameters": [
          {
            "in": "query",
            "name": "days",
            "required": false,
            "schema": {
              "default": 7,
              "maximum": 90,
              "minimum": 1,
              "title": "Days",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Analytics Human Review Api Analytics Human Review Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Analytics Human Review",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/analytics/kpis": {
      "get": {
        "operationId": "analytics_kpis_api_analytics_kpis_get",
        "parameters": [
          {
            "in": "query",
            "name": "days",
            "required": false,
            "schema": {
              "default": 7,
              "maximum": 90,
              "minimum": 1,
              "title": "Days",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Analytics Kpis Api Analytics Kpis Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Analytics Kpis",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/analytics/outcomes": {
      "get": {
        "operationId": "analytics_outcomes_api_analytics_outcomes_get",
        "parameters": [
          {
            "in": "query",
            "name": "days",
            "required": false,
            "schema": {
              "default": 7,
              "maximum": 90,
              "minimum": 1,
              "title": "Days",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Analytics Outcomes Api Analytics Outcomes Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Analytics Outcomes",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/analytics/summary": {
      "get": {
        "operationId": "analytics_summary_api_analytics_summary_get",
        "parameters": [
          {
            "in": "query",
            "name": "days",
            "required": false,
            "schema": {
              "default": 7,
              "maximum": 90,
              "minimum": 1,
              "title": "Days",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Analytics Summary Api Analytics Summary Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Analytics Summary",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/audit": {
      "get": {
        "description": "Paginated audit log query against the ``events`` table.\n\nFilters are AND-composed; missing filters are dropped from the\nWHERE. ``total`` is a separate COUNT(*) over the same predicate so\nthe frontend pager works. Tenant scoping is handled by either\nBYPASSRLS (MSSP) or the events RLS policy (tenant).",
        "operationId": "audit_list_api_audit_get",
        "parameters": [
          {
            "in": "query",
            "name": "page",
            "required": false,
            "schema": {
              "default": 1,
              "minimum": 1,
              "title": "Page",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "page_size",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 500,
              "minimum": 1,
              "title": "Page Size",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "event_type",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Event Type"
            }
          },
          {
            "in": "query",
            "name": "aggregate_type",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Aggregate Type"
            }
          },
          {
            "in": "query",
            "name": "start_date",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Start Date"
            }
          },
          {
            "in": "query",
            "name": "end_date",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "End Date"
            }
          },
          {
            "in": "query",
            "name": "investigation_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Investigation Id"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Audit List Api Audit Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Audit List",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/audit/event-types": {
      "get": {
        "description": "Distinct event types present in the audit log \u2014 drives the UI filter.",
        "operationId": "audit_event_types_api_audit_event_types_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "title": "Response Audit Event Types Api Audit Event Types Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Audit Event Types",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/audit/investigation/{investigation_id}": {
      "get": {
        "description": "Per-investigation event timeline for the case-detail audit tab.",
        "operationId": "audit_investigation_api_audit_investigation__investigation_id__get",
        "parameters": [
          {
            "in": "path",
            "name": "investigation_id",
            "required": true,
            "schema": {
              "title": "Investigation Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 200,
              "maximum": 2000,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Audit Investigation Api Audit Investigation  Investigation Id  Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Audit Investigation",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/audit/stats": {
      "get": {
        "description": "Aggregate counters for the audit dashboard.",
        "operationId": "audit_stats_api_audit_stats_get",
        "parameters": [
          {
            "in": "query",
            "name": "hours",
            "required": false,
            "schema": {
              "default": 24,
              "maximum": 720,
              "minimum": 1,
              "title": "Hours",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Audit Stats Api Audit Stats Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Audit Stats",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/auth/assume-tenant": {
      "post": {
        "description": "MSSP impersonation: pin ``sessions.current_tenant`` to a slug or id.\n\nTenant-bound users cannot call this; they're already scoped. MSSP\nusers use this to switch which tenant they're viewing without\nre-logging-in. ``slug=null + tenant_id=null`` clears the pin and\nreturns to cross-tenant view.",
        "operationId": "assume_tenant_api_auth_assume_tenant_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AssumeTenantRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserPayload"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Assume Tenant",
        "tags": [
          "auth"
        ],
        "x-soctalk-auth": "session cookie (login) / none"
      }
    },
    "/api/auth/login": {
      "post": {
        "operationId": "login_api_auth_login_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LoginRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LoginResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Login",
        "tags": [
          "auth"
        ],
        "x-soctalk-auth": "session cookie (login) / none"
      }
    },
    "/api/auth/logout": {
      "post": {
        "operationId": "logout_api_auth_logout_post",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "boolean"
                  },
                  "title": "Response Logout Api Auth Logout Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Logout",
        "tags": [
          "auth"
        ],
        "x-soctalk-auth": "session cookie (login) / none"
      }
    },
    "/api/auth/me": {
      "get": {
        "operationId": "me_api_auth_me_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserPayload"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Me",
        "tags": [
          "auth"
        ],
        "x-soctalk-auth": "session cookie (login) / none"
      }
    },
    "/api/auth/password/change": {
      "post": {
        "operationId": "password_change_api_auth_password_change_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasswordChangeRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "boolean"
                  },
                  "title": "Response Password Change Api Auth Password Change Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Password Change",
        "tags": [
          "auth"
        ],
        "x-soctalk-auth": "session cookie (login) / none"
      }
    },
    "/api/chat/conversations": {
      "get": {
        "operationId": "list_conversations_api_chat_conversations_get",
        "parameters": [
          {
            "in": "query",
            "name": "investigation_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Investigation Id"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 20,
              "maximum": 100,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "offset",
            "required": false,
            "schema": {
              "default": 0,
              "minimum": 0,
              "title": "Offset",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/_ConversationListOut"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "List Conversations",
        "tags": [
          "chat"
        ],
        "x-soctalk-auth": "session cookie"
      },
      "post": {
        "operationId": "create_conversation_api_chat_conversations_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/_CreateConversationBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/_ConversationOut"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Create Conversation",
        "tags": [
          "chat"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/chat/conversations/{conv_id}": {
      "delete": {
        "operationId": "delete_conversation_api_chat_conversations__conv_id__delete",
        "parameters": [
          {
            "in": "path",
            "name": "conv_id",
            "required": true,
            "schema": {
              "title": "Conv Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "boolean"
                  },
                  "title": "Response Delete Conversation Api Chat Conversations  Conv Id  Delete",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Delete Conversation",
        "tags": [
          "chat"
        ],
        "x-soctalk-auth": "session cookie"
      },
      "get": {
        "operationId": "get_conversation_api_chat_conversations__conv_id__get",
        "parameters": [
          {
            "in": "path",
            "name": "conv_id",
            "required": true,
            "schema": {
              "title": "Conv Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/_ConversationDetailOut"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Conversation",
        "tags": [
          "chat"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/chat/conversations/{conv_id}/messages": {
      "post": {
        "description": "Append a user message and stream the assistant's reply.\n\nSession lifecycle is subtle:\n\n* Pre-stream reads/writes (lock the conversation row, daily cap\n  check, persist the user message, pre-load investigation summary)\n  happen on the **request-bound session**. The middleware commits\n  this session when the route returns 200, which releases the FOR\n  UPDATE lock \u2014 fine, the lock's job is done by then.\n* The streaming agent loop runs on a **fresh session** opened\n  inside the stream generator. Reusing the request session here\n  blew up with ``asyncpg.InterfaceError: another operation in\n  progress`` because the middleware's commit fires the moment the\n  route returns the StreamingResponse, while the agent is still\n  mid-query.\n\nRole-aware: MSSP-level callers get a BYPASSRLS session for the\nstream (so the agent's read tools can answer cross-tenant\nquestions); tenant-level callers get an app session with\n``tenant_context`` pinned to their home tenant.",
        "operationId": "post_message_api_chat_conversations__conv_id__messages_post",
        "parameters": [
          {
            "in": "path",
            "name": "conv_id",
            "required": true,
            "schema": {
              "title": "Conv Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/_PostMessageBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Post Message",
        "tags": [
          "chat"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/chat/conversations/{conv_id}/messages/{msg_id}/confirm": {
      "post": {
        "operationId": "confirm_action_api_chat_conversations__conv_id__messages__msg_id__confirm_post",
        "parameters": [
          {
            "in": "path",
            "name": "conv_id",
            "required": true,
            "schema": {
              "title": "Conv Id",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "msg_id",
            "required": true,
            "schema": {
              "title": "Msg Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Confirm Action Api Chat Conversations  Conv Id  Messages  Msg Id  Confirm Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Confirm Action",
        "tags": [
          "chat"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/chat/conversations/{conv_id}/stop": {
      "post": {
        "operationId": "stop_conversation_api_chat_conversations__conv_id__stop_post",
        "parameters": [
          {
            "in": "path",
            "name": "conv_id",
            "required": true,
            "schema": {
              "title": "Conv Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "boolean"
                  },
                  "title": "Response Stop Conversation Api Chat Conversations  Conv Id  Stop Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Stop Conversation",
        "tags": [
          "chat"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/events/stream": {
      "get": {
        "description": "Open-ended SSE stream that emits a ``ping`` every 25s.\n\nThe frontend's ``initSSE`` opens an EventSource against this path on\nevery authenticated page. Returning a real SSE stream (instead of\n404) keeps the layout's \"Live\"/\"Offline\" badge accurate and lets us\nlayer real events on later without a frontend change.\n\nConnection-pool note: the request goes through ``DBSessionMiddleware``\nwhich holds an ``AsyncSession`` open for the request lifetime \u2014 for\na long-lived stream that means the session lingers indefinitely and\nmulti-tab users would drain the pool. The auth dependency\n(``current_identity``) ran before this handler, so we explicitly\nclose the session before entering the yield loop and let the\nmiddleware's ``finally`` find an already-closed session (no-op).",
        "operationId": "events_stream_api_events_stream_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Events Stream",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/internal/adapter/checkpoint": {
      "get": {
        "description": "Durable ingest cursor (issue #17 fix 6). Restart-safe: the adapter\nresumes from here instead of an in-memory cursor that resets on pod\nreplacement.",
        "operationId": "get_checkpoint_api_internal_adapter_checkpoint_get",
        "parameters": [
          {
            "in": "query",
            "name": "source",
            "required": false,
            "schema": {
              "default": "wazuh",
              "title": "Source",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Get Checkpoint Api Internal Adapter Checkpoint Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Checkpoint",
        "tags": [
          "internal-adapter"
        ],
        "x-soctalk-auth": "service JWT (adapter token)"
      },
      "put": {
        "operationId": "put_checkpoint_api_internal_adapter_checkpoint_put",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CheckpointBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Put Checkpoint Api Internal Adapter Checkpoint Put",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Put Checkpoint",
        "tags": [
          "internal-adapter"
        ],
        "x-soctalk-auth": "service JWT (adapter token)"
      }
    },
    "/api/internal/adapter/config": {
      "get": {
        "description": "Adapter pulls a minimal tenant config snapshot for local caches.",
        "operationId": "fetch_config_api_internal_adapter_config_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Fetch Config Api Internal Adapter Config Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Fetch Config",
        "tags": [
          "internal-adapter"
        ],
        "x-soctalk-auth": "service JWT (adapter token)"
      }
    },
    "/api/internal/adapter/events": {
      "post": {
        "description": "Wazuh \u2192 native IR ingest.\n\nThe batch is validated against the shared ``soctalk_wire`` schema. Each\nevent runs through the triage pipeline, which now reserves an\nidempotency key in ``alert_source_events`` first (a replay no-ops),\ncoalesces bursts into alerts, auto-closes high-confidence FPs, and\npromotes the rest into cases. Writes are wrapped in ``tenant_context``\nso RLS WITH CHECK passes for the app-role session.\n\nFollowing the Netflix Dispatch \"filter action\" pattern, the response\nreports the disposition of EVERY event \u2014 including ``duplicate`` and\n``skipped_schema`` \u2014 so a consumer can account for coverage rather than\ninfer it from a bare count. ``schema_version`` on the batch drives\nadditive-only handling: a higher-than-supported version is processed\nbest-effort (unknown fields already ignored by the model) with a warning.",
        "operationId": "ingest_events_api_internal_adapter_events_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/IngestBatch"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Ingest Events Api Internal Adapter Events Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Ingest Events",
        "tags": [
          "internal-adapter"
        ],
        "x-soctalk-auth": "service JWT (adapter token)"
      }
    },
    "/api/internal/adapter/heartbeat": {
      "post": {
        "operationId": "heartbeat_api_internal_adapter_heartbeat_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AdapterHeartbeatPayload"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Heartbeat Api Internal Adapter Heartbeat Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Heartbeat",
        "tags": [
          "internal-adapter"
        ],
        "x-soctalk-auth": "service JWT (adapter token)"
      }
    },
    "/api/internal/worker/runs/claim": {
      "post": {
        "description": "Claim the oldest active run for the caller's tenant.\n\nReturns ``null`` (HTTP 200) when nothing is available \u2014 keeps the\nworker loop simple. Uses ``FOR UPDATE SKIP LOCKED`` so multiple\nreplicas can poll without contention.",
        "operationId": "claim_run_api_internal_worker_runs_claim_post",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "anyOf": [
                    {
                      "$ref": "#/components/schemas/ClaimedRun"
                    },
                    {
                      "type": "null"
                    }
                  ],
                  "title": "Response Claim Run Api Internal Worker Runs Claim Post"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Claim Run",
        "tags": [
          "internal-worker"
        ],
        "x-soctalk-auth": "service JWT (worker token)"
      }
    },
    "/api/internal/worker/runs/{run_id}/complete": {
      "post": {
        "description": "Mark the run terminal and optionally apply the verdict to the investigation.\n\nIdempotent on (run_id, lease_id). When ``disposition`` is supplied\nthe parent ``cases`` row transitions atomically with the case_run:\n\n  - ``close_fp`` \u2192 ``cases.status='auto_closed_fp'``, ``closed_at=now()``\n  - ``escalate`` \u2192 leaves ``cases.status='active'``, sets ``severity``\n    to at least 12 so the row sorts to the top of the MSSP queue\n  - ``leave_open`` (or omitted) \u2192 no change to the investigation",
        "operationId": "complete_run_api_internal_worker_runs__run_id__complete_post",
        "parameters": [
          {
            "in": "path",
            "name": "run_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Run Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CompletePayload"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Complete Run Api Internal Worker Runs  Run Id  Complete Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Complete Run",
        "tags": [
          "internal-worker"
        ],
        "x-soctalk-auth": "service JWT (worker token)"
      }
    },
    "/api/internal/worker/runs/{run_id}/heartbeat": {
      "post": {
        "description": "Extend the lease and persist current ``tokens_used`` + ``dollars_used``.\n\nPersisting both at heartbeat time is what keeps the per-run dollar\ncap honest across worker crashes: if the lease expires mid-run and\na different worker picks the run back up, it must see the spend\nthat was already incurred or it can blow through the cap a second\ntime at no further cost to the runaway customer.",
        "operationId": "heartbeat_run_api_internal_worker_runs__run_id__heartbeat_post",
        "parameters": [
          {
            "in": "path",
            "name": "run_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Run Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/WorkerHeartbeatPayload"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Heartbeat Run Api Internal Worker Runs  Run Id  Heartbeat Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Heartbeat Run",
        "tags": [
          "internal-worker"
        ],
        "x-soctalk-auth": "service JWT (worker token)"
      }
    },
    "/api/investigations": {
      "get": {
        "operationId": "list_investigations_api_investigations_get",
        "parameters": [
          {
            "in": "query",
            "name": "page",
            "required": false,
            "schema": {
              "default": 1,
              "minimum": 1,
              "title": "Page",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "page_size",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 500,
              "minimum": 1,
              "title": "Page Size",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "status",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Status"
            }
          },
          {
            "in": "query",
            "name": "phase",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Phase"
            }
          },
          {
            "in": "query",
            "name": "severity",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Severity"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InvestigationList"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "List Investigations",
        "tags": [
          "investigations-bridge"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/investigations/{investigation_id}": {
      "get": {
        "operationId": "get_investigation_api_investigations__investigation_id__get",
        "parameters": [
          {
            "in": "path",
            "name": "investigation_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Investigation Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Investigation"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Investigation",
        "tags": [
          "investigations-bridge"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/investigations/{investigation_id}/cancel": {
      "post": {
        "operationId": "post_cancel_investigation_api_investigations__investigation_id__cancel_post",
        "parameters": [
          {
            "in": "path",
            "name": "investigation_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Investigation Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CancelRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ActionResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Post Cancel Investigation",
        "tags": [
          "investigations-bridge"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/investigations/{investigation_id}/events": {
      "get": {
        "operationId": "get_events_api_investigations__investigation_id__events_get",
        "parameters": [
          {
            "in": "path",
            "name": "investigation_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Investigation Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 100,
              "maximum": 500,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EventTimelineResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Events",
        "tags": [
          "investigations-bridge"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/metrics/hourly": {
      "get": {
        "operationId": "hourly_api_metrics_hourly_get",
        "parameters": [
          {
            "in": "query",
            "name": "hours",
            "required": false,
            "schema": {
              "default": 24,
              "maximum": 168,
              "minimum": 1,
              "title": "Hours",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HourlyMetricsResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Hourly",
        "tags": [
          "metrics-bridge"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/metrics/overview": {
      "get": {
        "operationId": "overview_api_metrics_overview_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MetricsOverview"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Overview",
        "tags": [
          "metrics-bridge"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/mssp/alerts": {
      "get": {
        "operationId": "list_alerts_api_mssp_alerts_get",
        "parameters": [
          {
            "in": "query",
            "name": "status",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Status"
            }
          },
          {
            "in": "query",
            "name": "assessment",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Assessment"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 200,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/AlertDTO"
                  },
                  "title": "Response List Alerts Api Mssp Alerts Get",
                  "type": "array"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "List Alerts",
        "tags": [
          "ir-alerts"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/analytics/heatmap": {
      "get": {
        "operationId": "heatmap_api_mssp_analytics_heatmap_get",
        "parameters": [
          {
            "in": "query",
            "name": "dimension",
            "required": false,
            "schema": {
              "default": "alerts",
              "pattern": "^(alerts|cases)$",
              "title": "Dimension",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "days",
            "required": false,
            "schema": {
              "default": 30,
              "maximum": 180,
              "minimum": 1,
              "title": "Days",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HeatmapResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Heatmap",
        "tags": [
          "mssp-analytics"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/analytics/ranking": {
      "get": {
        "operationId": "ranking_api_mssp_analytics_ranking_get",
        "parameters": [
          {
            "in": "query",
            "name": "metric",
            "required": false,
            "schema": {
              "default": "ttv",
              "pattern": "^(ttv|ttr)$",
              "title": "Metric",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "days",
            "required": false,
            "schema": {
              "default": 30,
              "maximum": 180,
              "minimum": 1,
              "title": "Days",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "min_sample",
            "required": false,
            "schema": {
              "default": 10,
              "maximum": 1000,
              "minimum": 1,
              "title": "Min Sample",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 20,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RankingResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Ranking",
        "tags": [
          "mssp-analytics"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/analytics/trends": {
      "get": {
        "operationId": "trends_api_mssp_analytics_trends_get",
        "parameters": [
          {
            "in": "query",
            "name": "days",
            "required": false,
            "schema": {
              "default": 7,
              "maximum": 180,
              "minimum": 1,
              "title": "Days",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TrendsResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Trends",
        "tags": [
          "mssp-analytics"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/dashboard/open-by-tenant": {
      "get": {
        "operationId": "open_by_tenant_api_mssp_dashboard_open_by_tenant_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OpenByTenantResponse"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Open By Tenant",
        "tags": [
          "mssp-dashboard"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/dashboard/pending-reviews": {
      "get": {
        "operationId": "pending_reviews_api_mssp_dashboard_pending_reviews_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PendingReviewsResponse"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Pending Reviews",
        "tags": [
          "mssp-dashboard"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/dashboard/repeated-iocs": {
      "get": {
        "operationId": "repeated_iocs_api_mssp_dashboard_repeated_iocs_get",
        "parameters": [
          {
            "in": "query",
            "name": "days",
            "required": false,
            "schema": {
              "default": 7,
              "maximum": 90,
              "minimum": 1,
              "title": "Days",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 500,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RepeatedIocsResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Repeated Iocs",
        "tags": [
          "mssp-dashboard"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/dashboard/stuck-investigations": {
      "get": {
        "operationId": "stuck_investigations_api_mssp_dashboard_stuck_investigations_get",
        "parameters": [
          {
            "in": "query",
            "name": "hours",
            "required": false,
            "schema": {
              "default": 8,
              "maximum": 720,
              "minimum": 1,
              "title": "Hours",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/StuckInvestigationsResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Stuck Investigations",
        "tags": [
          "mssp-dashboard"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/dashboard/tenant-health": {
      "get": {
        "operationId": "tenant_health_api_mssp_dashboard_tenant_health_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TenantHealthResponse"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Tenant Health",
        "tags": [
          "mssp-dashboard"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/investigations": {
      "get": {
        "operationId": "list_cases_mssp_api_mssp_investigations_get",
        "parameters": [
          {
            "in": "query",
            "name": "tenant_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Tenant Id"
            }
          },
          {
            "in": "query",
            "name": "status",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Status"
            }
          },
          {
            "in": "query",
            "name": "severity_min",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "integer"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Severity Min"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 100,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/CaseSummary"
                  },
                  "title": "Response List Cases Mssp Api Mssp Investigations Get",
                  "type": "array"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "List Cases Mssp",
        "tags": [
          "ir-mssp"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/investigations/{investigation_id}": {
      "get": {
        "operationId": "get_case_mssp_api_mssp_investigations__investigation_id__get",
        "parameters": [
          {
            "in": "path",
            "name": "investigation_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Investigation Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CaseDetail"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Case Mssp",
        "tags": [
          "ir-mssp"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/investigations/{investigation_id}/events": {
      "get": {
        "operationId": "list_case_events_mssp_api_mssp_investigations__investigation_id__events_get",
        "parameters": [
          {
            "in": "path",
            "name": "investigation_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Investigation Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/CaseEventDTO"
                  },
                  "title": "Response List Case Events Mssp Api Mssp Investigations  Investigation Id  Events Get",
                  "type": "array"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "List Case Events Mssp",
        "tags": [
          "ir-mssp"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/investigations/{investigation_id}/facts": {
      "patch": {
        "operationId": "patch_case_facts_api_mssp_investigations__investigation_id__facts_patch",
        "parameters": [
          {
            "in": "path",
            "name": "investigation_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Investigation Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/FactsCorrectionRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "title": "Response Patch Case Facts Api Mssp Investigations  Investigation Id  Facts Patch",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Patch Case Facts",
        "tags": [
          "ir-mssp"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/investigations/{investigation_id}/messages": {
      "post": {
        "operationId": "post_analyst_message_api_mssp_investigations__investigation_id__messages_post",
        "parameters": [
          {
            "in": "path",
            "name": "investigation_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Investigation Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AnalystMessageRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "title": "Response Post Analyst Message Api Mssp Investigations  Investigation Id  Messages Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Post Analyst Message",
        "tags": [
          "ir-mssp"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/proposals": {
      "get": {
        "operationId": "list_pending_proposals_api_mssp_proposals_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/ProposalDTO"
                  },
                  "title": "Response List Pending Proposals Api Mssp Proposals Get",
                  "type": "array"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "List Pending Proposals",
        "tags": [
          "ir-proposals"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/proposals/{proposal_id}/approve": {
      "post": {
        "operationId": "approve_proposal_route_api_mssp_proposals__proposal_id__approve_post",
        "parameters": [
          {
            "in": "path",
            "name": "proposal_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Proposal Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ProposalDecisionRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "title": "Response Approve Proposal Route Api Mssp Proposals  Proposal Id  Approve Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Approve Proposal Route",
        "tags": [
          "ir-proposals"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/proposals/{proposal_id}/reject": {
      "post": {
        "operationId": "reject_proposal_route_api_mssp_proposals__proposal_id__reject_post",
        "parameters": [
          {
            "in": "path",
            "name": "proposal_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Proposal Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ProposalDecisionRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "title": "Response Reject Proposal Route Api Mssp Proposals  Proposal Id  Reject Post",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Reject Proposal Route",
        "tags": [
          "ir-proposals"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants": {
      "get": {
        "operationId": "list_tenants_api_mssp_tenants_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/TenantRead"
                  },
                  "title": "Response List Tenants Api Mssp Tenants Get",
                  "type": "array"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "List Tenants",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      },
      "post": {
        "operationId": "create_tenant_api_mssp_tenants_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TenantCreate"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TenantRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Create Tenant",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/onboard": {
      "post": {
        "description": "Async tenant onboarding: writes initial rows, enqueues a provisioning\njob, and returns immediately with state=``provisioning``.\n\nThe worker picks up the job, runs the stepwise reconcile on\n:class:`TenantController`, and flips the tenant to ``active`` when\nthe namespace + secrets + Helm releases + workloads are all ready.",
        "operationId": "onboard_tenant_api_mssp_tenants_onboard_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TenantOnboard"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TenantRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Onboard Tenant",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}": {
      "get": {
        "operationId": "get_tenant_api_mssp_tenants__tenant_id__get",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TenantRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Tenant",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}/adapter-status": {
      "get": {
        "description": "Server-side proxy to the tenant adapter's ``/health/ready``.\n\nRelays the adapter JSON verbatim on success (``ok``, ``alerts_forwarded``,\n``last_alert_ts``, ``last_ingest_error`` \u2026), defaulting ``reachable`` to\n``True`` so the poller has one uniform field to branch on. On ANY failure\n(DNS, connect timeout, non-2xx, malformed body) returns HTTP 200 with a\nsoft-failure body ``{\"reachable\": false, \"error\": \"<msg>\"}`` \u2014 never a\n5xx \u2014 so the detail page renders a degraded badge instead of an error.\n\nNOT a browser CORS call: the per-tenant adapter Service has no ingress and\nis only reachable from the control plane's cluster network.",
        "operationId": "get_tenant_adapter_status_api_mssp_tenants__tenant_id__adapter_status_get",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Get Tenant Adapter Status Api Mssp Tenants  Tenant Id  Adapter Status Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Tenant Adapter Status",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}/branding": {
      "patch": {
        "operationId": "update_tenant_branding_api_mssp_tenants__tenant_id__branding_patch",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BrandingUpdate"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BrandingRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Update Tenant Branding",
        "tags": [
          "mssp-tenant-branding"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}/events": {
      "get": {
        "operationId": "list_events_api_mssp_tenants__tenant_id__events_get",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 100,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/LifecycleEventRead"
                  },
                  "title": "Response List Events Api Mssp Tenants  Tenant Id  Events Get",
                  "type": "array"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "List Events",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: analyst / mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}/external-siem": {
      "get": {
        "description": "Masked read of a tenant's external-SIEM connection material.",
        "operationId": "get_tenant_external_siem_api_mssp_tenants__tenant_id__external_siem_get",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ExternalSiemRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Tenant External Siem",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      },
      "patch": {
        "description": "Profile-agnostic external-SIEM update.\n\nDual-write ordering (mirrors ``llm_config.update_tenant_llm:267-270``):\n\n  1. Apply non-None payload fields to the ``IntegrationConfig.wazuh_*``\n     columns + flush, inside ``tenant_context``.\n  2. ``session.commit()`` \u2014 Postgres is authoritative and lands BEFORE\n     any K8s side effect.\n  3. Re-read the merged row, write/patch\n     ``Secret/tenant-external-siem-creds`` in ``tenant-<slug>`` (token key\n     omitted when unset).\n  4. Patch the ``soctalk-adapter`` Deployment annotation so its pod rolls\n     and mounts the freshly-written Secret.\n\nSteps 3-4 are best-effort: a K8s failure is logged via structlog and does\nNOT roll back the committed Postgres update \u2014 the user's intent is already\nrecorded authoritatively, and the provisioning worker re-reconciles the\nSecret on its next pass.",
        "operationId": "update_tenant_external_siem_api_mssp_tenants__tenant_id__external_siem_patch",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ExternalSiemPatch"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ExternalSiemRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Update Tenant External Siem",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}/integrations": {
      "get": {
        "operationId": "get_integrations_api_mssp_tenants__tenant_id__integrations_get",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/IntegrationsDTO"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Integrations",
        "tags": [
          "ir-integrations"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      },
      "patch": {
        "operationId": "patch_integrations_api_mssp_tenants__tenant_id__integrations_patch",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/IntegrationsPatch"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/IntegrationsDTO"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Patch Integrations",
        "tags": [
          "ir-integrations"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}/llm": {
      "get": {
        "operationId": "get_tenant_llm_api_mssp_tenants__tenant_id__llm_get",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LlmConfigRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Tenant Llm",
        "tags": [
          "mssp-tenant-llm"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      },
      "patch": {
        "operationId": "update_tenant_llm_api_mssp_tenants__tenant_id__llm_patch",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LlmConfigUpdate"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LlmConfigRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Update Tenant Llm",
        "tags": [
          "mssp-tenant-llm"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}/llm/api-key": {
      "delete": {
        "description": "Explicit clear path for a tenant's LLM API key.\n\nPrimary action is the Postgres column; the K8s Secret is deleted\nbest-effort alongside. Idempotent \u2014 returns 204 whether or not a\nkey was previously set. Use when rotating without immediately\nproviding a replacement (operator handoff, tenant churn).",
        "operationId": "clear_tenant_llm_api_key_api_mssp_tenants__tenant_id__llm_api_key_delete",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Clear Tenant Llm Api Key",
        "tags": [
          "mssp-tenant-llm"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}:decommission": {
      "post": {
        "description": "Enqueue tear-down of a tenant's data plane.\n\nFlips the tenant to ``decommissioning`` + records a\n``decommission_started`` lifecycle event synchronously, then\nenqueues a ``tenant.decommission`` job for the provisioning worker\nto drive. Returns 202 immediately so the wizard/UI can poll.",
        "operationId": "decommission_tenant_api_mssp_tenants__tenant_id__decommission_post",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "force",
            "required": false,
            "schema": {
              "default": false,
              "title": "Force",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TenantRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Decommission Tenant",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}:issue-agent": {
      "post": {
        "description": "Create-or-reuse the TenantInstallation for this tenant and mint a\nfresh bootstrap token.\n\nRe-calling revokes any un-consumed prior bootstrap token for the\ninstallation (a lost token never remains valid). Runtime tokens are\nuntouched \u2014 this endpoint only addresses the bootstrap leg.",
        "operationId": "issue_agent_api_mssp_tenants__tenant_id__issue_agent_post",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AgentIssuance"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Issue Agent",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}:resume": {
      "post": {
        "operationId": "resume_tenant_api_mssp_tenants__tenant_id__resume_post",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TenantRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Resume Tenant",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}:retry": {
      "post": {
        "description": "Retry provisioning for a degraded tenant.\n\nReopens a failed ``tenant.provision`` job (or inserts a fresh one),\nbut first handles the still-ACTIVE-job window: the worker flips the\ntenant to degraded on the FIRST ProvisionError while the job only\nreaches status='failed' after max_attempts. During that backoff\nwindow a pending/in_flight row still exists, and blind-inserting a\nduplicate would violate the partial unique index\n``uq_provisioning_jobs_active`` (500). Same pre-check pattern as\n``llm_config.update_tenant_llm``.",
        "operationId": "retry_provisioning_api_mssp_tenants__tenant_id__retry_post",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProvisioningJobRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Retry Provisioning",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}:retry-install": {
      "post": {
        "description": "Operator-facing recovery for a wedged L2 install.\n\nUse when the tenant agent crashed mid-job and the installation is\nstuck in ``provisioning`` with an in_flight AgentJob. This:\n  1. Reclaims any in_flight AgentJobs for the tenant's installation\n     (regardless of age \u2014 operator-triggered bypasses the timeout).\n  2. Resets any ``failed`` terminal jobs to ``pending`` so the agent\n     can retry them on its next claim.\n  3. Returns the installation's current state for the caller to poll.\n\nDoes not re-enqueue preflight; if the failure was earlier in the\npipeline a re-register from the agent side will reset the state.",
        "operationId": "retry_install_api_mssp_tenants__tenant_id__retry_install_post",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RetryInstallResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Retry Install",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/tenants/{tenant_id}:suspend": {
      "post": {
        "operationId": "suspend_tenant_api_mssp_tenants__tenant_id__suspend_post",
        "parameters": [
          {
            "in": "path",
            "name": "tenant_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Tenant Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TenantRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Suspend Tenant",
        "tags": [
          "mssp-tenants"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/mssp/users/{user_id}/password/reset": {
      "post": {
        "operationId": "admin_reset_api_mssp_users__user_id__password_reset_post",
        "parameters": [
          {
            "in": "path",
            "name": "user_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "User Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AdminResetResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Admin Reset",
        "tags": [
          "auth-admin"
        ],
        "x-soctalk-auth": "session \u2014 roles: mssp_admin / platform_admin"
      }
    },
    "/api/public/mssp-by-slug/{slug}": {
      "get": {
        "description": "Resolve an MSSP slug to identity + branding.\n\nUsed by the canonical UI when the URL is ``<slug>.mssp.<base>`` so\nthe login page renders the MSSP's branding pre-login. No auth \u2014\nsame threat model as tenant-by-slug (slugs are public DNS).",
        "operationId": "mssp_by_slug_api_public_mssp_by_slug__slug__get",
        "parameters": [
          {
            "in": "path",
            "name": "slug",
            "required": true,
            "schema": {
              "title": "Slug",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PublicMssp"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Mssp By Slug",
        "tags": [
          "public-tenant"
        ],
        "x-soctalk-auth": "none (public)"
      }
    },
    "/api/public/scope-by-slug/{slug}": {
      "get": {
        "description": "Resolve any slug \u2014 MSSP or tenant \u2014 to its public scope.\n\nSingle entry point so the canonical UI doesn't need to encode\n``mssp.`` vs ``customer.`` in hostnames. Slugs MUST be globally\nunique across organizations + tenants for this to work; we look\nup MSSPs first (rare, low cardinality), then tenants. A collision\nreturns the MSSP \u2014 provisioning is expected to reject overlapping\nslugs at create-time.",
        "operationId": "scope_by_slug_api_public_scope_by_slug__slug__get",
        "parameters": [
          {
            "in": "path",
            "name": "slug",
            "required": true,
            "schema": {
              "title": "Slug",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PublicScope"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Scope By Slug",
        "tags": [
          "public-tenant"
        ],
        "x-soctalk-auth": "none (public)"
      }
    },
    "/api/public/tenant-by-slug/{slug}": {
      "get": {
        "description": "Resolve a public slug to identity + branding.\n\nNo auth: slugs are intentionally public-facing (DNS, URLs). Both\n``tenants`` and ``branding_configs`` have no RLS policies \u2014 they're\nread freely under the soctalk_app role. Slugs are constrained to\n``[a-z0-9-]{3,32}`` at provisioning so probing random patterns\ncan't cheaply enumerate.",
        "operationId": "tenant_by_slug_api_public_tenant_by_slug__slug__get",
        "parameters": [
          {
            "in": "path",
            "name": "slug",
            "required": true,
            "schema": {
              "title": "Slug",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PublicTenant"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Tenant By Slug",
        "tags": [
          "public-tenant"
        ],
        "x-soctalk-auth": "none (public)"
      }
    },
    "/api/review/pending": {
      "get": {
        "description": "List pending HIL reviews from the V1 pending_reviews table.\n\nRole-aware tenant scoping:\n  - MSSP / platform admins \u2192 BYPASSRLS session, cross-tenant view.\n  - Tenant-scoped users \u2192 app-role session with ``tenant_context``,\n    RLS restricts the SELECT to their own tenant.",
        "operationId": "review_pending_api_review_pending_get",
        "parameters": [
          {
            "in": "query",
            "name": "page",
            "required": false,
            "schema": {
              "default": 1,
              "minimum": 1,
              "title": "Page",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "page_size",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Page Size",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/_PendingReviewList"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Review Pending",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/review/{review_id}": {
      "get": {
        "description": "Fetch a single HIL review by id, role-aware tenant-scoped.\n\nUses the same two-pool RLS idiom as ``_resolve_pending_review``:\nMSSP-level roles read cross-tenant via the BYPASSRLS session; tenant\nusers are pinned by ``tenant_context`` so a cross-tenant id 404s the\nsame way a truly missing row does (never disclose existence).",
        "operationId": "review_detail_api_review__review_id__get",
        "parameters": [
          {
            "in": "path",
            "name": "review_id",
            "required": true,
            "schema": {
              "title": "Review Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/_PendingReviewItem"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Review Detail",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/review/{review_id}/approve": {
      "post": {
        "description": "Analyst approved the AI verdict \u2014 investigation stays escalated.",
        "operationId": "review_approve_api_review__review_id__approve_post",
        "parameters": [
          {
            "in": "path",
            "name": "review_id",
            "required": true,
            "schema": {
              "title": "Review Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/_ApproveBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/_ReviewActionResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Review Approve",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/review/{review_id}/expire": {
      "post": {
        "description": "Retire a pending review without an analyst verdict.\n\nUsed for operator-driven cleanup (stale or duplicate queue items) and\nfor the future timeout-driven expiration job. Distinct from\napprove/reject/request-info: emits ``HUMAN_REVIEW_EXPIRED`` rather\nthan ``HUMAN_DECISION_RECEIVED``, so the audit trail shows the row\nwas retired administratively, not adjudicated.\n\nAuthorization: MSSP-level roles (platform_admin, mssp_admin) can\nexpire any tenant's review. Tenant-scoped roles can only expire\ntheir own; ``_resolve_pending_review`` enforces both via the same\nrole-aware session pattern used by the other actions.",
        "operationId": "review_expire_api_review__review_id__expire_post",
        "parameters": [
          {
            "in": "path",
            "name": "review_id",
            "required": true,
            "schema": {
              "title": "Review Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/_ExpireBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/_ReviewActionResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Review Expire",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/review/{review_id}/reject": {
      "post": {
        "description": "Analyst overrode the AI verdict \u2014 close as false positive.",
        "operationId": "review_reject_api_review__review_id__reject_post",
        "parameters": [
          {
            "in": "path",
            "name": "review_id",
            "required": true,
            "schema": {
              "title": "Review Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/_ApproveBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/_ReviewActionResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Review Reject",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/review/{review_id}/request-info": {
      "post": {
        "description": "Analyst requested additional information \u2014 investigation stays open.",
        "operationId": "review_request_info_api_review__review_id__request_info_post",
        "parameters": [
          {
            "in": "path",
            "name": "review_id",
            "required": true,
            "schema": {
              "title": "Review Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/_RequestInfoBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/_ReviewActionResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Review Request Info",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/settings": {
      "get": {
        "description": "Read-only settings snapshot.\n\nThe full settings UX edits MCP integration credentials in the legacy\nsingle-tenant install; in V1 those live in per-tenant\nIntegrationConfig (see /api/llm/* and the MSSP tenants UI). We\nreturn a non-empty shape with everything ``readonly=True`` so the\npage renders the read-only view rather than an error.",
        "operationId": "settings_get_api_settings_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Settings Get Api Settings Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Settings Get",
        "tags": [
          "legacy-stubs"
        ],
        "x-soctalk-auth": "session cookie"
      }
    },
    "/api/tenant/branding": {
      "get": {
        "operationId": "get_own_branding_api_tenant_branding_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BrandingRead"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Get Own Branding",
        "tags": [
          "tenant-branding"
        ],
        "x-soctalk-auth": "tenant session (customer_viewer / tenant_admin)"
      }
    },
    "/api/tenant/investigations": {
      "get": {
        "operationId": "list_cases_tenant_api_tenant_investigations_get",
        "parameters": [
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/CustomerCaseSummary"
                  },
                  "title": "Response List Cases Tenant Api Tenant Investigations Get",
                  "type": "array"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "List Cases Tenant",
        "tags": [
          "ir-tenant"
        ],
        "x-soctalk-auth": "tenant session (customer_viewer / tenant_admin)"
      }
    },
    "/api/tenant/investigations/{investigation_id}": {
      "get": {
        "description": "Customer-facing investigation view. Returns a narrower projection than the\nMSSP endpoint: no hypotheses, no active directives, no policies, no\nrelated-investigation graph. Only the timeline summary + basic investigation metadata.\n\nEven if the investigation row itself were misclassified, the response shape\nhere does not carry MSSP-internal facts \u2014 customer portal cannot\nleak them through this endpoint regardless.",
        "operationId": "get_case_tenant_api_tenant_investigations__investigation_id__get",
        "parameters": [
          {
            "in": "path",
            "name": "investigation_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "title": "Investigation Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CustomerCaseDetail"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Get Case Tenant",
        "tags": [
          "ir-tenant"
        ],
        "x-soctalk-auth": "tenant session (customer_viewer / tenant_admin)"
      }
    },
    "/api/tenant/llm": {
      "get": {
        "description": "Tenant-scoped read: provider/model + whether a tenant override\nis set. ``has_api_key=False`` here means \"no per-tenant key\" \u2014 the\nruns-worker is using the MSSP's shared install key (still works,\njust MSSP-funded). ``has_api_key=True`` + the masked preview means\nBYOK is active.",
        "operationId": "tenant_get_llm_api_tenant_llm_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LlmConfigRead"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Tenant Get Llm",
        "tags": [
          "tenant-llm"
        ],
        "x-soctalk-auth": "tenant session (tenant_admin)"
      }
    },
    "/api/tenant/llm/api-key": {
      "delete": {
        "description": "Revert to the MSSP's shared install key.\n\nA naive \"delete the Secret\" path would crash-loop the runs-worker\n(mountPath unreadable). Instead we read the install-shared key\nand re-mirror it into ``tenant-<slug>/tenant-llm-key`` so the\nruns-worker keeps running after restart. If the install key\nisn't readable from this L1 (cross-cluster path, RBAC denial),\nthe call fails 409 and the tenant override is preserved \u2014 the\ntenant operator chose to clear, but we'd rather refuse than\nleave them with a missing-key crash.",
        "operationId": "tenant_clear_llm_key_api_tenant_llm_api_key_delete",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LlmConfigRead"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Tenant Clear Llm Key",
        "tags": [
          "tenant-llm"
        ],
        "x-soctalk-auth": "tenant session (tenant_admin)"
      },
      "put": {
        "description": "Tenant pastes their own LLM API key.\n\nSame dual-write contract as the MSSP path: Postgres FIRST (the\nauthoritative store), then best-effort K8s Secret + runs-worker\nrolling restart so the new credential is in use within seconds\nof the call returning.\n\nProvider and model are NOT settable from this endpoint by design \u2014\nthe install's outbound egress policy is provider-pinned, and\nletting a tenant_admin flip provider would either DoS their own\nruns (egress blocked) or require us to re-render the Cilium\npolicy at request-time. Both are worse than \"MSSP picks the\nprovider; tenant supplies their own credential within it\".",
        "operationId": "tenant_put_llm_key_api_tenant_llm_api_key_put",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TenantLlmKeyUpdate"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LlmConfigRead"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Tenant Put Llm Key",
        "tags": [
          "tenant-llm"
        ],
        "x-soctalk-auth": "tenant session (tenant_admin)"
      }
    },
    "/health/live": {
      "get": {
        "operationId": "live_health_live_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Live Health Live Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Live",
        "tags": [
          "health"
        ],
        "x-soctalk-auth": "none (public)"
      }
    },
    "/health/ready": {
      "get": {
        "description": "Return 200 when DB is reachable; 503 otherwise.",
        "operationId": "ready_health_ready_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Ready Health Ready Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Ready",
        "tags": [
          "health"
        ],
        "x-soctalk-auth": "none (public)"
      }
    }
  }
}