{"components":{"schemas":{"LegalHoldInput":{"additionalProperties":false,"properties":{"authority_reference":{"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._:/-]*$","type":"string"},"jurisdiction_reference":{"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._:/-]*$","type":"string"},"matter_reference":{"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._:/-]*$","type":"string"},"reason_code":{"enum":["contractual-dispute","investigation","litigation","other-approved","preservation-notice","regulatory-inquiry"],"type":"string"},"scope":{"properties":{"from_seq":{"minimum":0,"type":"integer"},"through_seq":{"minimum":0,"nullable":true,"type":"integer"}},"type":"object"}},"required":["matter_reference","reason_code","authority_reference","jurisdiction_reference"],"type":"object"},"RetentionPolicyInput":{"additionalProperties":false,"properties":{"disposition":{"enum":["review","archive","retain"],"type":"string"},"legal_basis_reference":{"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._:/-]*$","type":"string"},"name":{"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._:/-]*$","type":"string"},"retention_days":{"maximum":36500,"minimum":1,"type":"integer"}},"required":["name","retention_days","legal_basis_reference","disposition"],"type":"object"},"SignerAuthorizationInput":{"additionalProperties":false,"properties":{"new_key_proof_b64":{"maxLength":88,"minLength":88,"pattern":"^[A-Za-z0-9+/]{86}==$","type":"string"},"new_public_key_b64":{"maxLength":44,"minLength":44,"pattern":"^[A-Za-z0-9+/]{43}=$","type":"string"},"tenant_id":{"maxLength":64,"type":"string"}},"required":["new_public_key_b64","new_key_proof_b64"],"type":"object"},"TrustRegistrationInput":{"additionalProperties":false,"properties":{"public_key_b64":{"maxLength":44,"minLength":44,"type":"string"},"sender":{"maxLength":4096,"minLength":1,"type":"string"},"tenant_id":{"maxLength":64,"type":"string"}},"required":["sender","public_key_b64"],"type":"object"},"TrustRevocationInput":{"additionalProperties":false,"oneOf":[{"required":["sender"]},{"required":["sender_token"]}],"properties":{"public_key_b64":{"maxLength":44,"minLength":44,"type":"string"},"sender":{"maxLength":4096,"minLength":1,"type":"string"},"sender_token":{"maxLength":4096,"minLength":1,"type":"string"},"tenant_id":{"maxLength":64,"type":"string"}},"type":"object"}},"securitySchemes":{"bearerAuth":{"bearerFormat":"opaque API credential","scheme":"bearer","type":"http"}}},"info":{"description":"Tenant-scoped, role-authorized decision-evidence and records-governance API. Use an HTTP Bearer credential when authentication is configured. Signet7 provides tamper-evidence; it does not guarantee legal admissibility or regulatory certification.","title":"Signet7 API","version":"0.2.0rc1"},"openapi":"3.0.3","paths":{"/admin":{"get":{"description":"Self-contained human console for people, billing, VSN qualification, and audit. Machine bearer credentials are not accepted.","responses":{"200":{"description":"Admin console HTML"}},"summary":"Company admin console"}},"/api/v1/account/activation":{"get":{"description":"Requires the HttpOnly account session cookie. Lists catalog unlocks and remaining steps. offer_live remains false.","responses":{"200":{"description":"Activation card"},"401":{"description":"Account session required"}},"summary":"Read the tenant activation card"}},"/api/v1/account/entitlements":{"get":{"parameters":[{"in":"query","name":"tenant_id","required":false,"schema":{"maxLength":64,"type":"string"}}],"responses":{"200":{"description":"Server-projected effective capabilities"},"401":{"description":"Unauthorized"},"403":{"description":"Tenant scope denied"}},"security":[{"bearerAuth":[]}],"summary":"Read effective tenant entitlements"}},"/api/v1/account/invites":{"post":{"description":"Hashed one-time invite. Machine bearer is rejected. offer_live remains false.","responses":{"201":{"description":"Invite token issued once"},"401":{"description":"Account session required"},"403":{"description":"CSRF or origin denied"}},"summary":"Invite a billing, signer, or auditor person"}},"/api/v1/account/invites/accept":{"post":{"responses":{"200":{"description":"Person recorded"},"400":{"description":"Invite unusable"}},"summary":"Accept a one-time tenant invite"}},"/api/v1/account/keys":{"post":{"description":"Business+ api.automation only. Raw token returned once. offer_live remains false.","responses":{"201":{"description":"Key issued"},"400":{"description":"Not entitled or rejected"},"401":{"description":"Account session required"}},"summary":"Issue a hashed control-plane API key"}},"/api/v1/admin/audit":{"get":{"description":"Requires the HttpOnly admin session cookie. Machine bearer is rejected.","responses":{"200":{"description":"Audit events"},"401":{"description":"Admin session required"}},"summary":"Read append-only admin audit events"}},"/api/v1/admin/billing":{"get":{"description":"Requires the HttpOnly admin session cookie. Machine bearer is rejected. Stripe test-mode only. offer_live remains false until tax and qualification checkout are separately activated.","responses":{"200":{"description":"Catalog, entitlements, and offer_live=false"},"401":{"description":"Admin session required"}},"summary":"Read billing snapshot"}},"/api/v1/admin/login-config":{"get":{"responses":{"200":{"description":"Whether local login or OIDC is available"}},"summary":"Read non-secret admin identity configuration"}},"/api/v1/admin/logout":{"post":{"responses":{"200":{"description":"Session revoked"},"401":{"description":"Admin session required"},"403":{"description":"CSRF token required"}},"summary":"Revoke the current human admin session"}},"/api/v1/admin/me":{"get":{"description":"Requires the HttpOnly admin session cookie. Machine bearer is rejected.","responses":{"200":{"description":"Human principal"},"401":{"description":"Admin session required"}},"summary":"Read the current human principal"}},"/api/v1/admin/overview":{"get":{"description":"Requires the HttpOnly admin session cookie. Machine bearer is rejected. Returns the Verify through Enterprise catalog, current entitlement, and coarse security status. offer_live remains false.","responses":{"200":{"description":"Program ladder and coarse security status"},"401":{"description":"Admin session required"}},"summary":"Company overview across all five programs"}},"/api/v1/admin/people":{"get":{"description":"Requires the HttpOnly admin session cookie. Machine bearer is rejected.","responses":{"200":{"description":"People in the session tenant"},"401":{"description":"Admin session required"}},"summary":"List tenant people"},"post":{"description":"Requires CSRF header and people.write. Machine bearer is rejected.","responses":{"201":{"description":"Person created"},"400":{"description":"Person rejected"},"401":{"description":"Admin session required"},"403":{"description":"CSRF or role denied"}},"summary":"Add a person to the session tenant"}},"/api/v1/admin/session":{"post":{"description":"Development-only local mapping when SIGNET7_ADMIN_DEV_LOGIN is enabled. Production accepts a verified OIDC authorization code or ID token. Machine bearer cannot be combined with a human cookie.","responses":{"200":{"description":"Opaque session cookie issued"},"401":{"description":"OIDC required or invalid human identity"}},"summary":"Create a human admin session"}},"/api/v1/admin/vsn":{"get":{"description":"Requires the HttpOnly admin session cookie. Machine bearer is rejected. This is a qualification directory, not a live customer-enrolled managed network.","responses":{"200":{"description":"Enrollment list"},"401":{"description":"Admin session required"}},"summary":"List VSN qualification enrollments"}},"/api/v1/admin/vsn/enroll":{"post":{"description":"Two distinct administrators required. Machine bearer is rejected.","responses":{"200":{"description":"Pending second-admin approval"},"201":{"description":"Enrollment committed"},"401":{"description":"Admin session required"},"403":{"description":"CSRF or role denied"},"409":{"description":"Approval rejected"}},"summary":"Request or approve a VSN enrollment"}},"/api/v1/anchors/reconcile":{"post":{"responses":{"200":{"description":"Backlog reconciled"},"202":{"description":"One or more receipts remain pending"}},"security":[{"bearerAuth":[]}],"summary":"Reconcile missing external anchor receipts (admin only)"}},"/api/v1/audit-events":{"get":{"description":"Returns a bounded page beneath one signed immutable cutoff. Follow next_cursor with the same snapshot token through the cutoff; a page that reaches the cutoff is not proof that the caller fetched prior pages.","parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}},{"in":"query","name":"limit","schema":{"default":100,"maximum":1000,"minimum":1,"type":"integer"}},{"description":"Opaque keyset cursor returned by the preceding page.","in":"query","name":"cursor","schema":{"type":"string"}},{"description":"Signed immutable cutoff token returned by the first page.","in":"query","name":"snapshot","schema":{"type":"string"}}],"responses":{"200":{"description":"Audit events and integrity status"},"402":{"content":{"application/json":{"schema":{"properties":{"code":{"enum":["entitlement_required"],"type":"string"},"entitlement_state":{"type":"string"},"error":{"type":"string"},"program_id":{"type":"string"},"programs_url":{"enum":["/pricing"],"type":"string"},"required_capability":{"type":"string"}},"required":["error","code","required_capability","program_id"],"type":"object"}}},"description":"Active Signet7 program entitlement required"},"403":{"description":"Auditor or admin role required"}},"security":[{"bearerAuth":[]}],"summary":"Read the tenant-filtered control-plane audit chain"}},"/api/v1/billing/cancel":{"post":{"description":"First-party cancel. A Stripe portal is not required. If no subscription exists, the server reports that fact. Live charges remain disabled until a separate offer activation.","requestBody":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"tenant_id":{"maxLength":64,"type":"string"}},"type":"object"}}},"required":false},"responses":{"200":{"description":"Cancel recorded or no subscription exists"},"401":{"description":"Unauthorized"},"403":{"description":"Tenant scope denied"}},"security":[{"bearerAuth":[]}],"summary":"Cancel tenant access without a billing portal"}},"/api/v1/billing/checkout-session":{"post":{"description":"Uses a server-owned provider price identifier and server-owned success/cancel URLs. Client-supplied price identifiers and return URLs are ignored by design.","requestBody":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"program_id":{"enum":["individual","professional","business","enterprise"],"type":"string"},"tenant_id":{"maxLength":64,"type":"string"}},"required":["program_id"],"type":"object"}}},"required":true},"responses":{"201":{"description":"Stripe test checkout session created"},"400":{"description":"Program unavailable or invalid request"},"401":{"description":"Unauthorized"},"403":{"description":"Tenant scope denied"},"503":{"description":"Billing is not configured"}},"security":[{"bearerAuth":[]}],"summary":"Create a Stripe test checkout session"}},"/api/v1/billing/portal-session":{"post":{"description":"Uses the customer identifier from the tenant's server-side subscription projection and a server-owned return URL.","requestBody":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"tenant_id":{"maxLength":64,"type":"string"}},"type":"object"}}},"required":false},"responses":{"201":{"description":"Stripe test billing portal session created"},"401":{"description":"Unauthorized"},"403":{"description":"Tenant scope denied"},"409":{"description":"No billing account for tenant"},"503":{"description":"Billing is not configured"}},"security":[{"bearerAuth":[]}],"summary":"Create a Stripe test billing portal session"}},"/api/v1/billing/webhooks/stripe":{"post":{"description":"Verifies the Stripe signature, rejects tenant/program/price mismatches, and projects subscription state idempotently without retaining payment payloads.","parameters":[{"in":"header","name":"Stripe-Signature","required":true,"schema":{"minLength":1,"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}},"required":true},"responses":{"200":{"description":"Signed event accepted or idempotently ignored"},"400":{"description":"Invalid signature or subscription contract"},"503":{"description":"Billing is not configured"}},"summary":"Apply a signed Stripe test subscription event"}},"/api/v1/checkpoints/latest":{"get":{"parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}}],"responses":{"200":{"description":"Current checkpoint"},"400":{"description":"Integrity verification failed"}},"security":[{"bearerAuth":[]}],"summary":"Read the latest local evidence head and external anchor status"}},"/api/v1/commercial/catalog":{"get":{"description":"Returns server-owned capability definitions. Provider price identifiers are never returned, and approved display amounts are optional configuration.","responses":{"200":{"description":"Commercial program catalog"}},"summary":"Read the public commercial program catalog"}},"/api/v1/decisions":{"post":{"requestBody":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"action_taken":{"description":"Canonical ASCII action with optional parenthesized arguments. The exact input is signature/idempotency-bound; only the canonical identifier is persisted. Unknown identifiers fail closed.","maxLength":512,"minLength":1,"type":"string"},"agent_id":{"maxLength":10000,"type":"string"},"claimed_sender":{"maxLength":10000,"type":"string"},"message_body":{"maxLength":10000,"type":"string"},"message_id":{"maxLength":10000,"type":"string"},"public_key_b64":{"maxLength":10000,"type":"string"},"tenant_id":{"maxLength":10000,"type":"string"},"vsn_signature":{"description":"Base64 v3 signature over sender, message_id, body, and exact action_taken.","maxLength":10000,"type":"string"}},"required":["agent_id","message_id","claimed_sender","message_body","action_taken"],"type":"object"}}},"required":true},"responses":{"200":{"description":"Idempotent replay of an existing record"},"201":{"description":"Recorded and anchoring completed or disabled"},"202":{"description":"Committed; external anchor reconciliation pending"},"400":{"description":"Malformed, duplicate-key, or invalid request"},"401":{"description":"Unauthorized"},"403":{"description":"Role or tenant scope denied"},"409":{"description":"message_id reused for a different request"},"413":{"description":"Request body exceeds the configured limit"},"415":{"description":"Content-Type must be application/json"},"429":{"description":"Mutation rate limit exceeded"}},"security":[{"bearerAuth":[]}],"summary":"Evaluate policy and seal a decision"}},"/api/v1/diagnostics/readiness":{"get":{"description":"Admin-only dependency, chain-integrity, anchor, signer, and worker readiness signals from the same local cached snapshot as /readyz.","responses":{"200":{"description":"Ready with detailed checks"},"401":{"description":"Unauthorized"},"403":{"description":"Admin role required"},"503":{"description":"Not ready with detailed checks"}},"security":[{"bearerAuth":[]}],"summary":"Detailed cached readiness diagnostics"}},"/api/v1/email/send":{"post":{"description":"Requires the email:send capability. Local SMTP and Gmail are pilot transports. provider=ses uses the same configured SES sender lock and email.send.ses entitlement as /api/v1/email/send-ses.","requestBody":{"content":{"application/json":{"schema":{"properties":{"destinations":{"items":{"type":"string"},"type":"array"},"eml_base64":{"type":"string"},"eml_encoding":{"type":"string"},"gmail_address":{"type":"string"},"gmail_app_password":{"type":"string"},"provider":{"enum":["smtp","gmail","ses"],"type":"string"},"smtp_host":{"type":"string"},"smtp_port":{"type":"integer"},"source":{"type":"string"},"tenant_id":{"maxLength":64,"type":"string"}},"required":["eml_base64"],"type":"object"}}},"required":true},"responses":{"200":{"description":"Message accepted by the selected transport"},"400":{"description":"Invalid signed message or send parameters"},"401":{"description":"Unauthorized"},"402":{"content":{"application/json":{"schema":{"properties":{"code":{"enum":["entitlement_required"],"type":"string"},"entitlement_state":{"type":"string"},"error":{"type":"string"},"program_id":{"type":"string"},"programs_url":{"enum":["/pricing"],"type":"string"},"required_capability":{"type":"string"}},"required":["error","code","required_capability","program_id"],"type":"object"}}},"description":"Active Signet7 program entitlement required"},"403":{"description":"Tenant scope or capability denied"},"503":{"description":"SES sender is not configured"}},"security":[{"bearerAuth":[]}],"summary":"Send a signed s7-email-1 .eml via SMTP, Gmail, or SES"}},"/api/v1/email/send-ses":{"post":{"description":"Enterprise sender operation. Requires email.send.ses entitlement and a configured SES sender; it does not alter free recipient verification.","requestBody":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"eml_base64":{"type":"string"},"tenant_id":{"maxLength":64,"type":"string"}},"required":["eml_base64"],"type":"object"}}},"required":true},"responses":{"200":{"description":"SES accepted the message"},"400":{"description":"Invalid signed message"},"401":{"description":"Unauthorized"},"402":{"content":{"application/json":{"schema":{"properties":{"code":{"enum":["entitlement_required"],"type":"string"},"entitlement_state":{"type":"string"},"error":{"type":"string"},"program_id":{"type":"string"},"programs_url":{"enum":["/pricing"],"type":"string"},"required_capability":{"type":"string"}},"required":["error","code","required_capability","program_id"],"type":"object"}}},"description":"Active Signet7 program entitlement required"},"403":{"description":"Tenant scope denied"},"503":{"description":"SES sender is not configured"}},"security":[{"bearerAuth":[]}],"summary":"Send a composed Signet7-sealed message through configured SES"}},"/api/v1/email/sign":{"post":{"description":"Requires the email:sign capability. Uses the tenant's dedicated, persistent email-signing key (DPAPI-protected locally or KMS-backed), composes a message (plain text, optional HTML alternative, optional Cc, optional attachments), signs under s7-email-1, and returns the signed .eml as base64. The private key is never returned by the network API; custody remains in the configured local vault or KMS. Setting enroll=true additionally requires trust:write authority.","requestBody":{"content":{"application/json":{"schema":{"properties":{"attachments":{"items":{"properties":{"content_base64":{"type":"string"},"content_type":{"default":"application/octet-stream","type":"string"},"filename":{"type":"string"}},"required":["filename","content_base64"],"type":"object"},"type":"array"},"body":{"description":"text/plain body","type":"string"},"cc_address":{"type":"string"},"enroll":{"default":false,"type":"boolean"},"from_address":{"type":"string"},"html_body":{"description":"Optional text/html alternative","type":"string"},"message_id":{"type":"string"},"selector":{"default":"default","type":"string"},"subject":{"type":"string"},"tenant_id":{"type":"string"},"to_address":{"type":"string"}},"required":["from_address","to_address","subject","body"],"type":"object"}}},"required":true},"responses":{"201":{"description":"Signed message created; response includes eml_base64, public_key_b64, key_fingerprint, message_id, and enrolled"},"400":{"description":"Missing or invalid field, or sign failure"},"401":{"description":"Unauthorized"},"402":{"content":{"application/json":{"schema":{"properties":{"code":{"enum":["entitlement_required"],"type":"string"},"entitlement_state":{"type":"string"},"error":{"type":"string"},"program_id":{"type":"string"},"programs_url":{"enum":["/pricing"],"type":"string"},"required_capability":{"type":"string"}},"required":["error","code","required_capability","program_id"],"type":"object"}}},"description":"Active Signet7 program entitlement required"},"403":{"description":"Role or tenant scope denied"},"413":{"description":"Request body exceeds the configured limit"}},"security":[{"bearerAuth":[]}],"summary":"Compose and sign an s7-email-1 .eml"}},"/api/v1/email/verify":{"post":{"description":"Independent of ledger /api/v1/verify. Accepts raw UTF-8 or base64 .eml bytes and returns signature, MIME/header/part component results, and integrity_ok. Binding is resolved server-side from the tenant trust registry (TENANT_BOUND or SELF_SIGNED); clients cannot supply a binding claim. Replay is observed when a local email replay store is configured.","requestBody":{"content":{"application/json":{"schema":{"properties":{"eml":{"description":"Raw .eml text or base64 payload","type":"string"},"eml_encoding":{"default":"utf-8","enum":["utf-8","base64","text"],"type":"string"},"tenant_id":{"type":"string"}},"required":["eml"],"type":"object"}}},"required":true},"responses":{"200":{"description":"Verification result; binding is TENANT_BOUND when the envelope sender/key is present in the tenant trust registry, otherwise SELF_SIGNED for cryptographically valid messages"},"401":{"description":"Unauthorized"},"403":{"description":"Tenant scope mismatch"},"413":{"description":"Payload too large"},"422":{"description":"Unsupported profile"}},"security":[{"bearerAuth":[]}],"summary":"Verify an s7-email-1 .eml (component-level email integrity)"}},"/api/v1/evidence-bundle":{"get":{"parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/zip":{"schema":{"format":"binary","type":"string"}}},"description":"Evidence ZIP"},"402":{"content":{"application/json":{"schema":{"properties":{"code":{"enum":["entitlement_required"],"type":"string"},"entitlement_state":{"type":"string"},"error":{"type":"string"},"program_id":{"type":"string"},"programs_url":{"enum":["/pricing"],"type":"string"},"required_capability":{"type":"string"}},"required":["error","code","required_capability","program_id"],"type":"object"}}},"description":"Active Signet7 program entitlement required"},"403":{"description":"Auditor or admin role required"}},"security":[{"bearerAuth":[]}],"summary":"Download a portable checksum-manifested evidence bundle"}},"/api/v1/export":{"get":{"parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}}],"responses":{"200":{"description":"signet7-export-v1"},"402":{"content":{"application/json":{"schema":{"properties":{"code":{"enum":["entitlement_required"],"type":"string"},"entitlement_state":{"type":"string"},"error":{"type":"string"},"program_id":{"type":"string"},"programs_url":{"enum":["/pricing"],"type":"string"},"required_capability":{"type":"string"}},"required":["error","code","required_capability","program_id"],"type":"object"}}},"description":"Active Signet7 program entitlement required"}},"security":[{"bearerAuth":[]}],"summary":"Export full tenant chain (admin)"}},"/api/v1/honeypot/senders":{"get":{"responses":{"200":{"description":"OK"},"401":{"description":"Unauthorized"}},"security":[{"bearerAuth":[]}],"summary":"List registered honeypot sender addresses"},"post":{"requestBody":{"content":{"application/json":{"schema":{"properties":{"label":{"default":"honeypot","type":"string"},"sender":{"format":"email","type":"string"}},"required":["sender"],"type":"object"}}},"required":true},"responses":{"201":{"description":"Sender registered"},"400":{"description":"Invalid sender address"},"401":{"description":"Unauthorized"}},"security":[{"bearerAuth":[]}],"summary":"Register a honeypot sender address"}},"/api/v1/ledger":{"get":{"parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}},{"in":"header","name":"X-Tenant-ID","schema":{"type":"string"}},{"in":"query","name":"limit","schema":{"default":100,"maximum":500,"minimum":1,"type":"integer"}},{"in":"query","name":"cursor","schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"401":{"description":"Unauthorized"},"403":{"description":"Tenant scope mismatch"}},"security":[{"bearerAuth":[]}],"summary":"List decision blocks for a tenant"}},"/api/v1/ledger/epochs/rollover":{"post":{"responses":{"200":{"description":"Epoch rollover completed or not required"},"400":{"description":"Invalid rollover request"},"401":{"description":"Authentication required"},"403":{"description":"Admin role required"},"409":{"description":"Epoch boundary or durable state conflict"},"503":{"description":"Independent rollover authorities unavailable"}},"security":[{"bearerAuth":[]}],"summary":"Advance a full authenticated ledger epoch (admin only)"}},"/api/v1/legal-holds":{"get":{"parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}}],"responses":{"200":{"description":"Governance snapshot"}},"security":[{"bearerAuth":[]}],"summary":"Read signed legal-hold and retention state"},"post":{"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LegalHoldInput"}}},"required":true},"responses":{"201":{"description":"Legal hold recorded"},"400":{"description":"Invalid hold"},"403":{"description":"Admin role required"}},"security":[{"bearerAuth":[]}],"summary":"Place a signed legal hold (admin only)"}},"/api/v1/legal-holds/{hold_id}/release":{"post":{"parameters":[{"in":"path","name":"hold_id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"reason_code":{"enum":["counsel-release","hold-superseded","matter-closed","other-approved"],"type":"string"},"release_authority_reference":{"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._:/-]*$","type":"string"},"release_basis_reference":{"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._:/-]*$","type":"string"}},"required":["reason_code","release_authority_reference","release_basis_reference"],"type":"object"}}},"required":true},"responses":{"200":{"description":"Release event recorded"},"400":{"description":"Invalid or inactive hold"},"403":{"description":"Admin role required"}},"security":[{"bearerAuth":[]}],"summary":"Record release of an active legal hold (admin only)"}},"/api/v1/legal/disclosures":{"get":{"description":"Public candidate disclosures. uses_generative_ai is false. offer_live is false. Uploads are not retained by default. Crisis resource is 988.","responses":{"200":{"description":"Current disclosure object"}},"summary":"Read current privacy, AI, provider, cancel, trial, and safety disclosures"}},"/api/v1/privacy/deletion-request":{"post":{"description":"Records a fingerprint of the request subject, purges transient uploads, and does not store the raw identifier. This is not a tenant-wipe of the append-only evidence ledger.","requestBody":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"scope":{"maxLength":64,"type":"string"},"subject":{"maxLength":256,"type":"string"}},"required":["subject"],"type":"object"}}},"required":true},"responses":{"201":{"description":"Deletion request accepted"},"400":{"description":"subject is required"}},"summary":"Accept a deletion request without retaining raw subject bytes"}},"/api/v1/records/policy":{"get":{"parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}}],"responses":{"200":{"description":"Current policy"},"404":{"description":"No policy recorded"}},"security":[{"bearerAuth":[]}],"summary":"Read the current signed retention policy"},"put":{"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RetentionPolicyInput"}}},"required":true},"responses":{"201":{"description":"Signed policy event recorded"},"400":{"description":"Invalid policy"},"403":{"description":"Admin role required"}},"security":[{"bearerAuth":[]}],"summary":"Record a new retention-policy version (admin only)"}},"/api/v1/session":{"get":{"parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}}],"responses":{"200":{"description":"Non-secret session context"},"401":{"description":"Unauthorized"},"403":{"description":"Tenant scope mismatch"}},"security":[{"bearerAuth":[]}],"summary":"Resolve the authenticated tenant and role"}},"/api/v1/signer-trust/authorizations":{"post":{"parameters":[{"in":"header","name":"X-Request-ID","required":true,"schema":{"maxLength":64,"minLength":1,"pattern":"^[A-Za-z0-9._-]+$","type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignerAuthorizationInput"}}},"required":true},"responses":{"201":{"description":"Ledgered, anchored signer authorization active"},"202":{"description":"Event committed; anchor or trust projection pending"},"400":{"description":"Invalid key, proof, tenant, or request ID"},"401":{"description":"Authentication required"},"403":{"description":"Admin role required"},"409":{"description":"Request ID reused for different authorization"},"413":{"description":"Request body too large"},"415":{"description":"JSON content type required"},"429":{"description":"Rate limit exceeded"}},"security":[{"bearerAuth":[]}],"summary":"Preauthorize a proved next ledger signer (admin only)"}},"/api/v1/stats":{"get":{"parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"401":{"description":"Unauthorized"},"403":{"description":"Tenant scope mismatch"}},"security":[{"bearerAuth":[]}],"summary":"Decision statistics for a tenant"}},"/api/v1/trust":{"delete":{"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TrustRevocationInput"}}},"required":true},"responses":{"200":{"description":"Revocation recorded"},"402":{"content":{"application/json":{"schema":{"properties":{"code":{"enum":["entitlement_required"],"type":"string"},"entitlement_state":{"type":"string"},"error":{"type":"string"},"program_id":{"type":"string"},"programs_url":{"enum":["/pricing"],"type":"string"},"required_capability":{"type":"string"}},"required":["error","code","required_capability","program_id"],"type":"object"}}},"description":"Active Signet7 program entitlement required"}},"security":[{"bearerAuth":[]}],"summary":"Revoke one or all sender public keys (admin only)"},"get":{"responses":{"200":{"description":"Tenant trust inventory"},"402":{"content":{"application/json":{"schema":{"properties":{"code":{"enum":["entitlement_required"],"type":"string"},"entitlement_state":{"type":"string"},"error":{"type":"string"},"program_id":{"type":"string"},"programs_url":{"enum":["/pricing"],"type":"string"},"required_capability":{"type":"string"}},"required":["error","code","required_capability","program_id"],"type":"object"}}},"description":"Active Signet7 program entitlement required"}},"security":[{"bearerAuth":[]}],"summary":"List sender-to-public-key trust bindings (auditor or admin)"},"post":{"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TrustRegistrationInput"}}},"required":true},"responses":{"201":{"description":"Registered"},"402":{"content":{"application/json":{"schema":{"properties":{"code":{"enum":["entitlement_required"],"type":"string"},"entitlement_state":{"type":"string"},"error":{"type":"string"},"program_id":{"type":"string"},"programs_url":{"enum":["/pricing"],"type":"string"},"required_capability":{"type":"string"}},"required":["error","code","required_capability","program_id"],"type":"object"}}},"description":"Active Signet7 program entitlement required"}},"security":[{"bearerAuth":[]}],"summary":"Bind a sender public key (admin only)"}},"/api/v1/trust/manifest":{"get":{"description":"Returns a tenant-signed snapshot of active sender-key bindings. Defaults sequence to the current ledger chain length when omitted.","parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}},{"in":"header","name":"X-Tenant-ID","schema":{"type":"string"}},{"description":"Optional ledger sequence bound; defaults to current chain length.","in":"query","name":"sequence","schema":{"type":"integer"}}],"responses":{"200":{"description":"Signed manifest"},"400":{"description":"Invalid sequence parameter"},"401":{"description":"Unauthorized"},"403":{"description":"Tenant scope mismatch"}},"security":[{"bearerAuth":[]}],"summary":"Signed trust-status manifest"}},"/api/v1/verify":{"get":{"parameters":[{"in":"query","name":"tenant_id","schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"401":{"description":"Unauthorized"},"403":{"description":"Tenant scope mismatch"}},"security":[{"bearerAuth":[]}],"summary":"Integrity report + optional WORM anchor"}},"/healthz":{"get":{"responses":{"200":{"description":"Process is alive"}},"summary":"Process liveness"}},"/metrics":{"get":{"responses":{"200":{"description":"text/plain"}},"security":[{"bearerAuth":[]}],"summary":"Prometheus text metrics (G4 lite)"}},"/openapi.json":{"get":{"responses":{"200":{"description":"OpenAPI 3 document"}},"summary":"This document"}},"/readyz":{"get":{"description":"Returns only ready/not-ready. Production uses asynchronous cached dependency probes and performs no synchronous remote work.","responses":{"200":{"description":"Ready"},"503":{"description":"Not ready"}},"summary":"Coarse public service readiness"}},"/version":{"get":{"responses":{"200":{"description":"Version information"}},"summary":"Non-secret service version and capability summary"}}},"servers":[{"description":"Current host","url":"/"}]}