openapi: 3.1.0
info:
  description: 'Public API reference for FlexGalaxy DotID identity. Build multi-tenant applications on DotID: provision accounts
    and organizations, manage IAM users/groups/policies, register your app, request quota, read audit events, and authorize
    access. Served through the gateway at api.flexgalaxy.ai using capability names (accounts, organizations, identity, developer,
    service-catalog, quota, audit, passport).'
  title: DotID API
  version: 1.0.0
tags:
- name: Workload Federation
- name: Accounts
- name: Organizations
- name: Identity
- name: Developer
- name: Service Catalog
- name: Quota
- name: PassPort
- name: Audit
paths:
  /oauth2/token:
    post:
      operationId: exchange
      parameters:
      - in: query
        name: request
        required: true
        schema:
          $ref: '#/components/schemas/TokenExchangeRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
          description: OK
      tags:
      - Workload Federation
  /.well-known/jwks.json:
    get:
      operationId: jwks
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties: {}
                type: object
          description: OK
      tags:
      - Workload Federation
  /.well-known/oauth-protected-resource:
    get:
      description: 'Discovery document for this protected resource. Every 401 from this service advertises this URL in its
        WWW-Authenticate header. Unauthenticated by design: discovery precedes authentication.'
      operationId: getOAuthProtectedResourceMetadata
      responses:
        '200':
          content:
            application/json:
              schema:
                description: RFC 9728 protected-resource metadata for the host the request carried.
                properties:
                  bearer_methods_supported:
                    description: How a bearer token may be presented. Always ["header"].
                    items:
                      type: string
                    type: array
                  resource:
                    description: This resource's identifier — the https origin that was called.
                    type: string
                  tls_client_certificate_bound_access_tokens:
                    description: Whether mutual-TLS certificate-bound access tokens are supported.
                    type: boolean
                type: object
          description: The protected-resource metadata document.
      security: []
      summary: OAuth 2.0 protected-resource metadata (RFC 9728)
      tags:
      - Workload Federation
  /accounts/v1/provision:
    post:
      operationId: provisionMember
      parameters:
      - in: header
        name: X-Account-Id
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProvisionMemberAccountRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ProvisioningJobResponse'
          description: OK
      tags:
      - Accounts
  /accounts/v1/provision/jobs:
    get:
      operationId: listProvisioningJobs
      parameters:
      - in: header
        name: X-Account-Id
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: status
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/ProvisioningJobSummary'
                type: array
          description: OK
      tags:
      - Accounts
  /accounts/v1/provision/batch:
    post:
      operationId: provisionBatch
      parameters:
      - in: header
        name: X-Account-Id
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: Idempotency-Key
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BatchProvisionRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/BatchProvisionResponse'
          description: OK
      tags:
      - Accounts
  /accounts/v1/provision/batch/{batchId}:
    get:
      operationId: getProvisionBatch
      parameters:
      - in: path
        name: batchId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/BatchProvisionStatusResponse'
          description: OK
      tags:
      - Accounts
  /accounts/v1/{accountId}:
    get:
      operationId: getAccount
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Accounts
    put:
      operationId: updateAccount
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateAccountRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Accounts
  /accounts/v1/{accountId}/status:
    put:
      operationId: updateStatus
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateAccountStatusRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Accounts
  /accounts/v1/{accountId}/close:
    post:
      operationId: closeAccount
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Accounts
  /accounts/v1/{accountId}/reopen:
    post:
      operationId: reopenAccount
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Accounts
  /accounts/v1/{accountId}/suspend:
    post:
      operationId: suspendAccount
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Accounts
  /accounts/v1/{accountId}/restore:
    post:
      operationId: restoreAccount
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Accounts
  /accounts/v1/{accountId}/service-installations:
    get:
      operationId: listForAccount
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/InstallationResponse'
                type: array
          description: OK
      tags:
      - Accounts
    post:
      operationId: installForAccount
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InstallRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/InstallationResponse'
          description: OK
      tags:
      - Accounts
  /accounts/v1/provision/jobs/{jobId}:
    get:
      operationId: getJobStatus
      parameters:
      - in: path
        name: jobId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ProvisioningJobResponse'
          description: OK
      tags:
      - Accounts
  /organizations/v1:
    get:
      operationId: listOrganization
      parameters:
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 50
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PageOrganization'
          description: OK
      tags:
      - Organizations
    post:
      operationId: createOrganization
      parameters:
      - in: header
        name: X-Account-Id
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOrganizationRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Organization'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}:
    get:
      operationId: getOrganization
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Organization'
          description: OK
      tags:
      - Organizations
    put:
      operationId: updateOrganization
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrganizationRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Organization'
          description: OK
      tags:
      - Organizations
    delete:
      operationId: deleteOrganization
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/tree:
    get:
      operationId: tree
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: rootOuId
        required: false
        schema:
          format: uuid
          type: string
      - in: query
        name: depth
        required: false
        schema:
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/OuTreeNode'
                type: array
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/scps:
    get:
      operationId: listScp
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/ServiceControlPolicy'
                type: array
          description: OK
      tags:
      - Organizations
    post:
      operationId: createScp
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateScpRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ServiceControlPolicy'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/scps/{scpId}:
    get:
      operationId: getScp
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: scpId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ServiceControlPolicy'
          description: OK
      tags:
      - Organizations
    put:
      operationId: updateScp
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: scpId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateScpRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ServiceControlPolicy'
          description: OK
      tags:
      - Organizations
    delete:
      operationId: deleteScp
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: scpId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/scps/{scpId}/attachments:
    get:
      operationId: listAttachments
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: scpId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/ScpAttachment'
                type: array
          description: OK
      tags:
      - Organizations
    post:
      operationId: attach
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: scpId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AttachScpRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ScpAttachment'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/scps/{scpId}/attachments/{targetType}/{targetId}:
    delete:
      operationId: detach
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: scpId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: targetType
        required: true
        schema:
          type: string
      - in: path
        name: targetId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/accounts:
    get:
      operationId: listAccounts
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 50
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PageAccount'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/accounts/{accountId}:
    delete:
      operationId: removeAccount
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Organizations
    get:
      operationId: getMemberAccount
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Organizations
    put:
      operationId: renameMemberAccount
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateAccountRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/accounts/{accountId}/suspend:
    post:
      operationId: suspendMemberAccount
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/accounts/{accountId}/restore:
    post:
      operationId: restoreMemberAccount
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/accounts/{accountId}/ou:
    put:
      operationId: moveAccountToOu
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MoveAccountRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Account'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/delegations:
    post:
      operationId: createOuDelegation
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOuDelegationRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AccountDelegationResponse'
          description: OK
      tags:
      - Organizations
    get:
      operationId: listOrgDelegations
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/AccountDelegationResponse'
                type: array
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/delegations/{delegationId}:
    delete:
      operationId: revokeOrgDelegation
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: delegationId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/ous:
    get:
      operationId: listOus
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: parentId
        required: false
        schema:
          format: uuid
          type: string
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 50
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PageOuSummary'
          description: OK
      tags:
      - Organizations
    post:
      operationId: createOu
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOuRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/OrganizationalUnit'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/ous/batch:
    post:
      operationId: batchCreateOus
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: Idempotency-Key
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BatchCreateOuRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/BatchCreateOuResponse'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/ous/{ouId}:
    get:
      operationId: getOu
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: ouId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/OrganizationalUnit'
          description: OK
      tags:
      - Organizations
    put:
      operationId: updateOu
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: ouId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOuRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/OrganizationalUnit'
          description: OK
      tags:
      - Organizations
    delete:
      operationId: deleteOu
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: ouId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/ous/{ouId}/accounts:
    get:
      operationId: listOuAccounts
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: ouId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 50
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PageAccount'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/leave:
    post:
      operationId: leaveOrganization
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/member-accounts/invitations:
    post:
      operationId: createMemberAccountInvitation
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateMemberAccountInvitationRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/MemberAccountInvitationDto'
          description: OK
      summary: Create a member-account invitation
      tags:
      - Organizations
    get:
      operationId: listMemberAccountInvitations
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/MemberAccountInvitationDto'
                type: array
          description: OK
      summary: List member-account invitations
      tags:
      - Organizations
  /organizations/v1/{orgId}/member-accounts/invitations/{inviteId}/accept:
    post:
      operationId: acceptMemberAccountInvitation
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: inviteId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AcceptMemberAccountInvitationRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/OuNodeWriteDto'
          description: OK
      summary: Accept a member-account invitation
      tags:
      - Organizations
  /organizations/v1/{orgId}/member-accounts/invitations/{inviteId}/decline:
    post:
      operationId: declineMemberAccountInvitation
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: inviteId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/MemberAccountInvitationDto'
          description: OK
      summary: Decline a member-account invitation
      tags:
      - Organizations
  /organizations/v1/{orgId}/account-lifecycle:
    get:
      operationId: listAccountLifecycle
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: status
        required: false
        schema:
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/AccountLifecycleDto'
                type: array
          description: OK
      summary: List an organization's accounts with lifecycle status (optional status filter)
      tags:
      - Organizations
  /organizations/v1/{orgId}/onboarding/accounts:
    post:
      operationId: onboardAccounts
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OnboardAccountsRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/OnboardAccountsResponse'
          description: OK
      summary: Bulk-create placeholder accounts for an enterprise org
      tags:
      - Organizations
  /organizations/v1/{orgId}/onboarding/accounts/{accountId}:close:
    post:
      operationId: closeAccount2
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AccountLifecycleDto'
          description: OK
      summary: Close an onboarded account — transition to terminal CLOSED (DotID#107 teardown)
      tags:
      - Organizations
  /organizations/v1/{orgId}/onboarding/accounts/{accountId}:grant-operator:
    post:
      operationId: grantFirstOperator
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AccountLifecycleDto'
          description: OK
      summary: First operator grant — materialize the account's authz projection
      tags:
      - Organizations
  /organizations/v1/{orgId}/onboarding/accounts/{accountId}:provision-service-user:
    post:
      operationId: provisionFirstServiceUser
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AccountLifecycleDto'
          description: OK
      summary: First service user — materialize the account's acc-* realm
      tags:
      - Organizations
  /organizations/v1/{orgId}/onboarding/accounts/{accountId}:purge:
    post:
      operationId: purgePlaceholderAccount
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          description: OK
      summary: Purge a never-materialized placeholder — hard-delete the row (DotID#107 teardown)
      tags:
      - Organizations
  /organizations/v1/{orgId}/service-installations:
    get:
      operationId: listForOrganization
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/InstallationResponse'
                type: array
          description: OK
      tags:
      - Organizations
    post:
      operationId: installForOrganization
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InstallRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/InstallationResponse'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/delegated-admins:
    get:
      operationId: listDelegatedAdmin
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/DelegatedAdministrator'
                type: array
          description: OK
      tags:
      - Organizations
    post:
      operationId: register
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetDelegatedAdminRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DelegatedAdministrator'
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/delegated-admins/{serviceName}:
    delete:
      operationId: deregister
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: serviceName
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Organizations
  /organizations/v1/{orgId}/ous/{ouId}/parent:
    patch:
      operationId: reparentOu
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: ouId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: If-Match
        required: false
        schema:
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReparentOuRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/OuNodeWriteDto'
          description: OK
      summary: Reparent an OU (If-Match required per D6)
      tags:
      - Organizations
  /organizations/v1/accounts/{accountId}/scps:
    get:
      operationId: listAccountScps
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/ServiceControlPolicy'
                type: array
          description: OK
      tags:
      - Organizations
  /identity/v1/self:
    get:
      operationId: getProfileSelf
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/SelfProfile'
          description: OK
      tags:
      - Identity
  /identity/v1/self/security:
    get:
      operationId: security
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/SelfSecurity'
          description: OK
      tags:
      - Identity
  /identity/v1/self/sessions:
    get:
      operationId: sessions
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/SelfSession'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/contexts:
    get:
      description: Returns backend-issued account, organization, delegated-app, and platform contexts available to the caller.
      operationId: contexts
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SessionContextsResponse'
          description: Session contexts available to the caller
        '401':
          description: Authentication required
      summary: List caller session contexts
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users:
    get:
      operationId: listIdcUser
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 20
          format: int32
          type: integer
      - in: query
        name: search
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PageUserRepresentation'
          description: OK
      tags:
      - Identity
    post:
      operationId: createIdcUser
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIdcUserRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IdcUserActivationResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users/{userId}:
    get:
      operationId: getIdcUser
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/UserRepresentation'
          description: OK
      tags:
      - Identity
    put:
      operationId: updateIdcUser
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateIdcUserRequest'
        required: true
      responses:
        '200':
          description: OK
      tags:
      - Identity
    delete:
      operationId: deleteIdcUser
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users/{userId}/activation:
    get:
      operationId: activation
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IdcUserActivationResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users/{userId}/activation/resend:
    post:
      operationId: resendActivation
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IdcUserActivationResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users/{userId}/reset-password:
    post:
      operationId: resetPassword
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users/{userId}/one-time-password:
    post:
      operationId: issueOneTimePassword
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IssuedOneTimePasswordResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users/{userId}/security:
    get:
      operationId: security2
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IdcUserSecurityResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users/{userId}/mfa-devices/{credentialId}:
    delete:
      operationId: removeMfaDevice
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      - in: path
        name: credentialId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IdcUserSecurityResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users/{userId}/mfa-enrollment:
    post:
      operationId: requireMfaEnrollment
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequireMfaEnrollmentRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IdcUserSecurityResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users/{userId}/disable:
    post:
      operationId: disable
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/identity-center/users/{userId}/enable:
    post:
      operationId: enable
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/workforce-invites:
    post:
      operationId: issue
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IssueWorkforceInviteRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IssuedWorkforceInviteResponse'
          description: OK
      summary: Issue a workforce invite for an organization administrator
      tags:
      - Identity
  /identity/v1/workforce-invites/accept:
    post:
      operationId: accept
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AcceptWorkforceInviteRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/WorkforceInviteResponse'
          description: OK
      summary: Accept an invite after authenticated email validation
      tags:
      - Identity
  /identity/v1/workforce-invites/inspect:
    post:
      operationId: inspect
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InspectWorkforceInviteRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/WorkforceInviteResponse'
          description: OK
      summary: Inspect an invite token for the branded invite page
      tags:
      - Identity
  /identity/v1/workforce-invites/{inviteId}/resend:
    post:
      operationId: resend
      parameters:
      - in: path
        name: inviteId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IssuedWorkforceInviteResponse'
          description: OK
      summary: Resend a workforce invite and revoke the previous pending token
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/groups:
    get:
      operationId: listGroup
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 50
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PageGroup'
          description: OK
      tags:
      - Identity
    post:
      operationId: createGroup
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateGroupRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Group'
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/groups/{groupId}:
    get:
      operationId: getGroup
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Group'
          description: OK
      tags:
      - Identity
    put:
      operationId: updateGroup
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateGroupRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Group'
          description: OK
      tags:
      - Identity
    delete:
      operationId: deleteGroup
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/groups/{groupId}/members:
    get:
      operationId: getMembers
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/GroupMember'
                type: array
          description: OK
      tags:
      - Identity
    post:
      operationId: addMember
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddMemberRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/GroupMember'
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/groups/{groupId}/members/{principalId}:
    delete:
      operationId: removeMember
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: principalId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/permission-sets:
    get:
      operationId: list
      parameters:
      - name: orgId
        in: path
        required: true
        schema:
          type: string
        description: Supplied by the public gateway route; the backend operation does not declare this segment.
      - in: query
        name: type
        required: false
        schema:
          type: string
      - in: query
        name: name_contains
        required: false
        schema:
          type: string
      - in: query
        name: account_id
        required: false
        schema:
          format: uuid
          type: string
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 50
          format: int32
          type: integer
      - in: query
        name: sort
        required: false
        schema:
          default: name,asc
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PagedResponsePermissionSetSummaryDto'
          description: OK
      summary: Paged list with filter (type, name_contains, account_id)
      tags:
      - Identity
    post:
      operationId: create
      parameters:
      - name: orgId
        in: path
        required: true
        schema:
          type: string
        description: Supplied by the public gateway route; the backend operation does not declare this segment.
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermissionSetWriteRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PermissionSetDetailDto'
          description: OK
      summary: Create a Custom permission set (Platform sets are server-seeded only)
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/permission-sets/managed-policies:
    get:
      operationId: listManagedPolicies
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/PolicyAttachmentResponse'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/permission-sets/{permissionSetId}:
    get:
      operationId: read
      parameters:
      - name: orgId
        in: path
        required: true
        schema:
          type: string
        description: Supplied by the public gateway route; the backend operation does not declare this segment.
      - in: path
        name: permissionSetId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PermissionSetDetailDto'
          description: OK
      summary: Read a permission set by id
      tags:
      - Identity
    patch:
      operationId: update
      parameters:
      - name: orgId
        in: path
        required: true
        schema:
          type: string
        description: Supplied by the public gateway route; the backend operation does not declare this segment.
      - in: path
        name: permissionSetId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermissionSetWriteRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PermissionSetDetailDto'
          description: OK
      summary: Update a Custom permission set (Platform → 403 platform_not_editable)
      tags:
      - Identity
    delete:
      operationId: delete
      parameters:
      - name: orgId
        in: path
        required: true
        schema:
          type: string
        description: Supplied by the public gateway route; the backend operation does not declare this segment.
      - in: path
        name: permissionSetId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          description: OK
      summary: Delete a Custom permission set (cascades assignments)
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/permission-sets/{permissionSetId}/policies:
    get:
      operationId: listAttachedPolicies
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: permissionSetId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/PolicyAttachmentResponse'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/permission-sets/{permissionSetId}/policies/{policyId}:
    post:
      operationId: attachPolicy
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: permissionSetId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
    delete:
      operationId: detachPolicy
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: permissionSetId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/permission-sets/{permissionSetId}/customer-policies:
    post:
      operationId: addCustomerPolicy
      parameters:
      - in: path
        name: permissionSetId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddCustomerPolicyRefRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PermissionSetCustomerPolicyRef'
          description: OK
      tags:
      - Identity
  /identity/v1/permission-sets/{permissionSetId}/customer-policies/{policyName}:
    delete:
      operationId: removeCustomerPolicy
      parameters:
      - in: path
        name: permissionSetId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyName
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/account-assignments:
    get:
      operationId: listAccountAssignment
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 50
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PageAccountAssignment'
          description: OK
      tags:
      - Identity
    post:
      operationId: create2
      parameters:
      - name: orgId
        in: path
        required: true
        schema:
          type: string
        description: Supplied by the public gateway route; the backend operation does not declare this segment.
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAssignmentRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                additionalProperties: {}
                type: object
          description: OK
      summary: Create N assignments atomically (D5 all-or-nothing)
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/account-assignments/{assignmentId}:
    get:
      operationId: getAccountAssignment
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: assignmentId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AccountAssignment'
          description: OK
      tags:
      - Identity
    delete:
      operationId: delete2
      parameters:
      - name: orgId
        in: path
        required: true
        schema:
          type: string
        description: Supplied by the public gateway route; the backend operation does not declare this segment.
      - in: path
        name: assignmentId
        required: true
        schema:
          format: uuid
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      - in: header
        name: X-Session-Context-Id
        required: false
        schema:
          type: string
      responses:
        '200':
          description: OK
      summary: Delete a single assignment (idempotent — 404 on missing per D6)
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/ous/{ouId}/assignments:
    get:
      operationId: listOuAccountAssignment
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: ouId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/OuAssignmentResponse'
                type: array
          description: OK
      tags:
      - Identity
    post:
      operationId: createOuAccountAssignment
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: ouId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOuAssignmentRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/OuAssignmentResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/organizations/{orgId}/ous/{ouId}/assignments/{id}:
    delete:
      operationId: deleteOuAccountAssignment
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: ouId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/delegations:
    post:
      operationId: createAccountDelegation
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAccountDelegationRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AccountDelegationResponse'
          description: OK
      tags:
      - Identity
    get:
      operationId: listAccountDelegation
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/AccountDelegationResponse'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/delegations/received:
    get:
      operationId: listReceived
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/AccountDelegationResponse'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/delegations/{delegationId}:
    delete:
      operationId: revoke
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: delegationId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/authorize:
    post:
      operationId: authorize
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizeRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AuthorizeResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/authorize/batch:
    post:
      operationId: authorizeBatch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BatchAuthorizeRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/BatchAuthorizeResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/service-users:
    post:
      operationId: createServiceUser
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateServiceUserRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                additionalProperties: {}
                type: object
          description: OK
      tags:
      - Identity
    get:
      operationId: listServiceUsers
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 20
          format: int32
          type: integer
      - in: query
        name: search
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PageIamUserDto'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/organization:
    get:
      operationId: getAccountOrganization
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AccountOrganizationResponse'
          description: OK
      summary: Resolve the organization the account belongs to
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/workload-identities/federated:
    post:
      operationId: createFederatedWorkloadIdentity
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateFederatedWorkloadIdentityRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                additionalProperties: {}
                type: object
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/iam-policies:
    post:
      operationId: createIamPolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIamPolicyRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamPolicy'
          description: OK
      tags:
      - Identity
    get:
      operationId: listIamPolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: scope
        required: false
        schema:
          default: all
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/IamPolicy'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/iam-policies/{policyId}:
    get:
      operationId: getIamPolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamPolicy'
          description: OK
      tags:
      - Identity
    put:
      operationId: updateIamPolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateIamPolicyRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamPolicy'
          description: OK
      tags:
      - Identity
    delete:
      operationId: deleteIamPolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/iam-policies/{policyId}/publish:
    post:
      operationId: publish
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                type: object
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/iam-policies/{policyId}/attachments:
    get:
      operationId: listIamPolicyAttachment
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/IamPolicyAttachment'
                type: array
          description: OK
      tags:
      - Identity
    post:
      operationId: attach2
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AttachPolicyRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamPolicyAttachment'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/iam-policies/{policyId}/attachments/{principalId}:
    delete:
      operationId: detach2
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: principalId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/service-users/{userId}:
    delete:
      operationId: deleteServiceUser
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/credentials:
    post:
      operationId: createCredential
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCredentialRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/CreateCredentialResponse'
          description: OK
      tags:
      - Identity
    get:
      operationId: listCredential
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: principalId
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/CredentialSummary'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/credentials/{credentialId}:
    get:
      operationId: getCredential
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: credentialId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/CredentialSummary'
          description: OK
      tags:
      - Identity
    put:
      operationId: updateCredential
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: credentialId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateCredentialRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/CredentialSummary'
          description: OK
      tags:
      - Identity
    delete:
      operationId: deleteCredential
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: credentialId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/credentials/{credentialId}/rotate:
    post:
      operationId: rotate
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: credentialId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RotateCredentialRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RotateCredentialResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/service-user-credential-policy:
    get:
      operationId: getServiceUserCredentialPolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ServiceUserCredentialPolicyResponse'
          description: OK
      tags:
      - Identity
    put:
      operationId: updateServiceUserCredentialPolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceUserCredentialPolicyRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ServiceUserCredentialPolicyResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/sts/assume-role:
    post:
      description: Evaluate the target role's trust policy and mint ASIA temp credentials scoped to the role in its account
      operationId: assumeRole
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssumeRoleRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AssumeRoleResponse'
          description: OK
      summary: Assume an IAM role
      tags:
      - Identity
  /identity/v1/workload/sts/assume-role:
    post:
      description: Evaluate the target role's trust policy against the calling workload identity and mint ASIA temp credentials
        scoped to the role in its account
      operationId: assumeRole2
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssumeRoleRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AssumeRoleResponse'
          description: OK
      summary: Assume an IAM role as a workload identity
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/roles:
    post:
      operationId: createRole
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRoleRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamRole'
          description: OK
      tags:
      - Identity
    get:
      operationId: listRole
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/IamRole'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/roles/{roleId}:
    get:
      operationId: getRole
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamRole'
          description: OK
      tags:
      - Identity
    put:
      operationId: updateRole
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamRole'
          description: OK
      tags:
      - Identity
    delete:
      operationId: deleteRole
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/roles/{roleId}/policies:
    post:
      operationId: attachPolicy2
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AttachRolePolicyRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamPolicyAttachment'
          description: OK
      tags:
      - Identity
    get:
      operationId: listAttachedPolicies2
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/IamPolicyAttachment'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/roles/{roleId}/policies/{policyId}:
    delete:
      operationId: detachPolicy2
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/users:
    get:
      operationId: listIamUser
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 20
          format: int32
          type: integer
      - in: query
        name: search
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PageIamUserDto'
          description: OK
      tags:
      - Identity
    post:
      operationId: createIamUser
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIamUserRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                additionalProperties:
                  type: string
                type: object
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/users/{userId}:
    get:
      operationId: getIamUser
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/UserRepresentation'
          description: OK
      tags:
      - Identity
    put:
      operationId: updateIamUser
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateIamUserRequest'
        required: true
      responses:
        '200':
          description: OK
      tags:
      - Identity
    delete:
      operationId: deleteIamUser
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/users/{userId}/policies:
    get:
      operationId: getUserPolicies
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/IamPolicyAttachment'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/users/{userId}/inline-policies:
    get:
      operationId: getUserInlinePolicies
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/IamInlinePolicy'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/users/{userId}/reset-password:
    post:
      operationId: resetPassword2
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/users/{userId}/reset-mfa:
    post:
      operationId: resetMfa
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AdminResetMfaRequest'
        required: true
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/iam-inline-policies:
    get:
      operationId: listIamInlinePolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: principalId
        required: true
        schema:
          type: string
      - in: query
        name: principalType
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/IamInlinePolicy'
                type: array
          description: OK
      tags:
      - Identity
    post:
      operationId: createIamInlinePolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateInlinePolicyRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamInlinePolicy'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/iam-inline-policies/{id}:
    get:
      operationId: getIamInlinePolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamInlinePolicy'
          description: OK
      tags:
      - Identity
    put:
      operationId: updateIamInlinePolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateInlinePolicyRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamInlinePolicy'
          description: OK
      tags:
      - Identity
    delete:
      operationId: deleteIamInlinePolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/iam-policies/{policyId}/versions:
    get:
      operationId: listVersions
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/IamPolicyVersion'
                type: array
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/iam-policies/{policyId}/versions/{versionNumber}:
    get:
      operationId: getVersion
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: versionNumber
        required: true
        schema:
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamPolicyVersion'
          description: OK
      tags:
      - Identity
    delete:
      operationId: deleteVersion
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: versionNumber
        required: true
        schema:
          format: int32
          type: integer
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/iam-policies/{policyId}/versions/{versionNumber}/set-default:
    post:
      operationId: setDefaultVersion
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: policyId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: versionNumber
        required: true
        schema:
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/IamPolicyVersion'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/permission-boundaries:
    post:
      operationId: attach3
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AttachBoundaryRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PermissionBoundary'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/permission-boundaries/{userId}:
    get:
      operationId: getPermissionBoundary
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PermissionBoundary'
          description: OK
      tags:
      - Identity
    delete:
      operationId: detach3
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/resource-policies:
    get:
      operationId: listResourcePolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/ResourcePolicy'
                type: array
          description: OK
      tags:
      - Identity
    post:
      operationId: createResourcePolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateResourcePolicyRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ResourcePolicy'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/resource-policies/{id}:
    get:
      operationId: getResourcePolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ResourcePolicy'
          description: OK
      tags:
      - Identity
    put:
      operationId: updateResourcePolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateResourcePolicyRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ResourcePolicy'
          description: OK
      tags:
      - Identity
    delete:
      operationId: deleteResourcePolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/trust-policies:
    get:
      operationId: listTrustPolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/TrustPolicySummary'
                type: array
          description: OK
      tags:
      - Identity
    post:
      operationId: createTrustPolicy
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTrustPolicyRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/TrustPolicySummary'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/trust-policies/{id}:
    delete:
      operationId: revoke2
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Identity
  /identity/v1/realm-discovery:
    post:
      operationId: discover
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RealmDiscoveryRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RealmDiscoveryResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/sts/get-session-token:
    post:
      description: Exchange an idc-* JWT for temporary access key / secret key / session token
      operationId: getSessionToken
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetSessionTokenRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/GetSessionTokenResponse'
          description: OK
      summary: Get temporary session credentials
      tags:
      - Identity
  /identity/v1/sts/sessions:
    get:
      description: List all non-expired temporary credentials for the calling user
      operationId: listSessions
      parameters:
      - in: query
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/CredentialSummary'
                type: array
          description: OK
      summary: List active STS sessions
      tags:
      - Identity
  /identity/v1/sts/revoke-session:
    post:
      description: Immediately invalidate a temporary credential by its access key ID
      operationId: revokeSession
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: string
              type: object
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                additionalProperties:
                  type: string
                type: object
          description: OK
      summary: Revoke a specific STS session
      tags:
      - Identity
  /identity/v1/sts/revoke-all-sessions:
    post:
      description: Immediately invalidate all temporary credentials for the calling user in the specified account
      operationId: revokeAllSessions
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: string
              type: object
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                additionalProperties: {}
                type: object
          description: OK
      summary: Revoke all STS sessions
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/access-keys/expiring:
    get:
      operationId: listExpiring
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: windowDays
        required: false
        schema:
          default: 30
          format: int32
          type: integer
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: pageSize
        required: false
        schema:
          default: 25
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ExpiringAccessKeysResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/access-keys/unused:
    get:
      operationId: listUnused
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: days
        required: false
        schema:
          default: 30
          format: int32
          type: integer
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: pageSize
        required: false
        schema:
          default: 25
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/UnusedAccessKeysResponse'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/root-credential/metadata:
    get:
      operationId: getMetadata
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RootCredentialMetadata'
          description: OK
      tags:
      - Identity
  /identity/v1/accounts/{accountId}/root-credential/audit:
    get:
      operationId: getAudit
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: since
        required: false
        schema:
          type: string
      - in: query
        name: limit
        required: false
        schema:
          default: 25
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RootAuditPage'
          description: OK
      tags:
      - Identity
  /developer/v1/services:
    post:
      operationId: createExternalDeveloperApi
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeveloperServiceRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DeveloperServiceResponse'
          description: OK
      tags:
      - Developer
    get:
      operationId: listExternalDeveloperApi
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/DeveloperServiceResponse'
                type: array
          description: OK
      tags:
      - Developer
  /developer/v1/services/{serviceId}:
    get:
      operationId: getExternalDeveloperApi
      parameters:
      - in: path
        name: serviceId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DeveloperServiceResponse'
          description: OK
      tags:
      - Developer
    delete:
      operationId: unregister
      parameters:
      - in: path
        name: serviceId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DeveloperServiceResponse'
          description: OK
      tags:
      - Developer
  /developer/v1/services/{serviceId}/submit:
    post:
      operationId: submit
      parameters:
      - in: path
        name: serviceId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeveloperServiceRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DeveloperServiceResponse'
          description: OK
      tags:
      - Developer
  /developer/v1/services/{serviceId}/review:
    get:
      operationId: review
      parameters:
      - in: path
        name: serviceId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ReviewStatusResponse'
          description: OK
      tags:
      - Developer
  /developer/v1/services/{serviceId}/credentials:
    get:
      operationId: getCredentials
      parameters:
      - in: path
        name: serviceId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DeveloperCredentialMetadata'
          description: OK
      tags:
      - Developer
  /developer/v1/services/{serviceId}/credentials:rotate:
    post:
      operationId: rotateCredentials
      parameters:
      - in: path
        name: serviceId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DeveloperCredentialSecret'
          description: OK
      tags:
      - Developer
  /developer/v1/test-users:
    post:
      operationId: createDeveloperTestUser
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTestUserRequest'
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/CreateTestUserResponse'
          description: OK
      tags:
      - Developer
    get:
      operationId: listDeveloperTestUser
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/TestUserSummary'
                type: array
          description: OK
      tags:
      - Developer
  /developer/v1/test-users/{userId}:
    delete:
      operationId: deleteDeveloperTestUser
      parameters:
      - in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Developer
  /service-catalog/v1/services:
    get:
      operationId: listPublishedServices
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/PublishedServiceResponse'
                type: array
          description: OK
      tags:
      - Service Catalog
  /service-catalog/v1/services/{serviceId}:
    get:
      operationId: getPublishedService
      parameters:
      - in: path
        name: serviceId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PublishedServiceResponse'
          description: OK
      tags:
      - Service Catalog
  /service-catalog/v1/installations/{installationId}:
    get:
      operationId: getInstallation
      parameters:
      - in: path
        name: installationId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/InstallationResponse'
          description: OK
      tags:
      - Service Catalog
    delete:
      operationId: uninstall
      parameters:
      - in: path
        name: installationId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/InstallationResponse'
          description: OK
      tags:
      - Service Catalog
  /quota/v1/accounts/me/quotas:
    get:
      operationId: listAccountQuotas
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/ServiceQuota'
                type: array
          description: OK
      tags:
      - Quota
  /quota/v1/accounts/me/quota-requests:
    get:
      operationId: listAccountRequests
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/QuotaIncreaseRequest'
                type: array
          description: OK
      tags:
      - Quota
    post:
      operationId: submitAccountRequest
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateQuotaIncreaseRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/QuotaIncreaseRequest'
          description: OK
      tags:
      - Quota
  /quota/v1/organizations/{orgId}/quotas:
    get:
      operationId: listQuotas
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/ServiceQuota'
                type: array
          description: OK
      tags:
      - Quota
  /quota/v1/organizations/{orgId}/quotas/{quotaId}:
    get:
      operationId: getQuota
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: quotaId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ServiceQuota'
          description: OK
      tags:
      - Quota
  /quota/v1/organizations/{orgId}/quota-requests:
    get:
      operationId: listRequests
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/QuotaIncreaseRequest'
                type: array
          description: OK
      tags:
      - Quota
    post:
      operationId: submitRequest
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateQuotaIncreaseRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/QuotaIncreaseRequest'
          description: OK
      tags:
      - Quota
  /quota/v1/organizations/{orgId}/quota-requests/{requestId}:
    delete:
      operationId: cancelRequest
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: requestId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          description: OK
      tags:
      - Quota
  /quota/v1/defaults:
    get:
      operationId: listDefaultQuotas
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/ServiceQuota'
                type: array
          description: OK
      tags:
      - Quota
  /quota/v1/plans:
    get:
      operationId: listPlan
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/Plan'
                type: array
          description: OK
      tags:
      - Quota
  /quota/v1/plans/{id}:
    get:
      operationId: getPlan
      parameters:
      - in: path
        name: id
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/Plan'
          description: OK
      tags:
      - Quota
  /quota/v1/runtime/{serviceCode}/{quotaCode}/applied:
    get:
      operationId: applied
      parameters:
      - in: path
        name: serviceCode
        required: true
        schema:
          type: string
      - in: path
        name: quotaCode
        required: true
        schema:
          type: string
      - in: query
        name: account_id
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: context_key
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AppliedQuotaView'
          description: OK
      tags:
      - Quota
  /quota/v1/runtime/{serviceCode}/{quotaCode}/usage:
    get:
      operationId: usage
      parameters:
      - in: path
        name: serviceCode
        required: true
        schema:
          type: string
      - in: path
        name: quotaCode
        required: true
        schema:
          type: string
      - in: query
        name: account_id
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: context_key
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/UsageView'
          description: OK
      tags:
      - Quota
    put:
      operationId: report
      parameters:
      - in: path
        name: serviceCode
        required: true
        schema:
          type: string
      - in: path
        name: quotaCode
        required: true
        schema:
          type: string
      - in: header
        name: X-Auth-Subject
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UsageReport'
        required: true
      responses:
        '202':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/UsageView'
          description: Accepted
      tags:
      - Quota
  /passport/v1/applications/{appId}:
    get:
      operationId: getApplication
      parameters:
      - in: path
        name: appId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
          description: OK
      tags:
      - PassPort
  /passport/v1/app-entry/resolve:
    post:
      operationId: resolveAppEntry
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResolveAppEntryRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AppEntryResolution'
          description: OK
      tags:
      - PassPort
  /passport/v1/launch-links:
    post:
      operationId: createLaunchLink
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateLaunchLinkRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/CreateLaunchLinkResponse'
          description: OK
      tags:
      - PassPort
  /passport/v1/launches/redeem:
    post:
      operationId: redeemLaunch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RedeemLaunchRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RedeemLaunchResponse'
          description: OK
      tags:
      - PassPort
  /passport/v1/launch-tickets/validate:
    post:
      operationId: validateLaunchTicket
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ValidateLaunchTicketRequest'
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ValidateLaunchTicketResponse'
          description: OK
      tags:
      - PassPort
  /audit/v1/me:
    get:
      description: Returns the caller's scope, own account, and accessible accounts for audit
      operationId: getAccessInfo
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AccessInfoResponse'
          description: OK
      summary: Get caller's access context
      tags:
      - Audit
  /audit/v1/accounts/{accountId}/events:
    get:
      description: Query audit events for an account with time range, actor, and source filters
      operationId: list2
      parameters:
      - in: path
        name: accountId
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: from
        required: true
        schema:
          format: date-time
          type: string
      - in: query
        name: to
        required: true
        schema:
          format: date-time
          type: string
      - in: query
        name: actorId
        required: false
        schema:
          type: string
      - in: query
        name: eventSource
        required: false
        schema:
          type: string
      - in: query
        name: correlation_id
        required: false
        schema:
          type: string
      - in: query
        name: export
        required: false
        schema:
          type: string
      - in: query
        name: page
        required: false
        schema:
          default: 0
          format: int32
          type: integer
      - in: query
        name: size
        required: false
        schema:
          default: 50
          format: int32
          type: integer
      responses:
        '200':
          content:
            '*/*':
              schema:
                type: object
          description: OK
      summary: List audit events
      tags:
      - Audit
  /audit/v1/events/{eventId}:
    get:
      description: Fetch one audit event by ID. The caller must be allowed to read the event's account.
      operationId: getByEventId
      parameters:
      - in: path
        name: eventId
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/AuditEvent'
          description: OK
      summary: Get a single audit event
      tags:
      - Audit
components:
  schemas:
    AcceptWorkforceInviteRequest:
      properties:
        token:
          minLength: 1
          type: string
      required:
      - token
      type: object
    Account:
      properties:
        cancellationWindowDays:
          format: int32
          type: integer
        closedAt:
          format: date-time
          type: string
        createdAt:
          format: date-time
          type: string
        description:
          type: string
        email:
          type: string
        id:
          format: uuid
          type: string
        management:
          type: boolean
        markedForDeletionAt:
          format: date-time
          type: string
        name:
          type: string
        organizationId:
          format: uuid
          type: string
        ouId:
          format: uuid
          type: string
        planId:
          format: uuid
          type: string
        realmName:
          type: string
        rootCredentialUserId:
          type: string
        rootUserId:
          type: string
        status:
          enum:
          - PENDING_APPROVAL
          - ACTIVE
          - SUSPENDED
          - CLOSED
          - REFUSED
          - PENDING_DELETION
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    AccountAssignment:
      properties:
        accountId:
          format: uuid
          type: string
        createdAt:
          format: date-time
          type: string
        groupId:
          format: uuid
          type: string
        id:
          format: uuid
          type: string
        organizationId:
          format: uuid
          type: string
        permissionSetId:
          format: uuid
          type: string
      type: object
    AccountAssignmentResponse:
      properties:
        account_id:
          format: uuid
          type: string
        account_name:
          type: string
        organization_id:
          format: uuid
          type: string
        organization_name:
          type: string
        permission_set_description:
          type: string
        permission_set_id:
          format: uuid
          type: string
        permission_set_name:
          type: string
        realm_name:
          type: string
        session_duration:
          type: string
      type: object
    AccountDelegationResponse:
      properties:
        createdAt:
          format: date-time
          type: string
        delegateeAccountId:
          format: uuid
          type: string
        delegatorAccountId:
          format: uuid
          type: string
        id:
          format: uuid
          type: string
        revokedAt:
          format: date-time
          type: string
        scopePermissionSetIds:
          items:
            format: uuid
            type: string
          type: array
      type: object
    AccountOrganizationResponse:
      properties:
        account_id:
          format: uuid
          type: string
        mgmt_account_id:
          format: uuid
          type: string
        name:
          type: string
        organization_id:
          format: uuid
          type: string
        ou_id:
          format: uuid
          type: string
        ou_name:
          type: string
        ou_path:
          type: string
        role:
          type: string
      type: object
    AccountSettingsRequest:
      properties:
        brandingHooks:
          additionalProperties: {}
          type: object
        defaultLocale:
          type: string
        defaultTheme:
          type: string
      type: object
    AccountSettingsResponse:
      properties:
        accountId:
          format: uuid
          type: string
        brandingHooks:
          additionalProperties: {}
          type: object
        defaultLocale:
          type: string
        defaultTheme:
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    AccountUpdateRequest:
      properties:
        attributes:
          additionalProperties:
            items:
              type: string
            type: array
          type: object
        firstName:
          type: string
        lastName:
          type: string
      type: object
    Action:
      properties:
        action_name:
          type: string
        builtin:
          type: boolean
        createdAt:
          format: date-time
          type: string
        description:
          type: string
        id:
          format: uuid
          type: string
        namespaceId:
          format: uuid
          type: string
      type: object
    ActionDefinition:
      properties:
        description:
          type: string
        name:
          minLength: 1
          type: string
      required:
      - name
      type: object
    ActionNamespace:
      properties:
        builtin:
          type: boolean
        createdAt:
          format: date-time
          type: string
        description:
          type: string
        id:
          format: uuid
          type: string
        namespace:
          type: string
        service_name:
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    ActionNamespaceResponse:
      properties:
        action_count:
          format: int64
          type: integer
        created_at:
          format: date-time
          type: string
        description:
          type: string
        id:
          format: uuid
          type: string
        namespace:
          type: string
        service_name:
          type: string
        updated_at:
          format: date-time
          type: string
      type: object
    ActionRebindRequest:
      properties:
        dry_run:
          type: boolean
        renames:
          items:
            $ref: '#/components/schemas/ActionRename'
          minItems: 1
          type: array
        scope:
          items:
            type: string
          minItems: 1
          type: array
        version:
          format: int32
          type: integer
      required:
      - renames
      - scope
      - version
      type: object
    ActionRebindResult:
      properties:
        changed_policy_count:
          format: int32
          type: integer
        changes:
          items:
            $ref: '#/components/schemas/PolicyChange'
          type: array
        dry_run:
          type: boolean
        rewritten_action_count:
          format: int32
          type: integer
        scanned_policy_count:
          format: int32
          type: integer
        scope:
          items:
            type: string
          type: array
        skipped_policy_count:
          format: int32
          type: integer
        validation_errors:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
        version:
          format: int32
          type: integer
      type: object
    ActionRename:
      properties:
        from:
          type: string
        to:
          type: string
      required:
      - from
      - to
      type: object
    AddCustomerPolicyRefRequest:
      properties:
        policy_name:
          maxLength: 255
          minLength: 0
          type: string
      required:
      - policy_name
      type: object
    AddMemberRequest:
      properties:
        principalId:
          minLength: 1
          type: string
        principalType:
          type: string
      required:
      - principalId
      type: object
    AdminResetMfaRequest:
      properties:
        credentialId:
          deprecated: true
          type: string
        reason:
          maxLength: 500
          minLength: 10
          type: string
      required:
      - reason
      type: object
    ApproveQuotaRequest:
      properties:
        decisionReason:
          type: string
      type: object
    AssumeRoleRequest:
      properties:
        durationSeconds:
          format: int32
          type: integer
        externalId:
          type: string
        roleFrn:
          minLength: 1
          type: string
        roleSessionName:
          minLength: 1
          type: string
      required:
      - roleFrn
      - roleSessionName
      type: object
    AssumeRoleResponse:
      properties:
        accessKeyId:
          type: string
        accountId:
          format: uuid
          type: string
        assumedRoleFrn:
          type: string
        expiration:
          format: date-time
          type: string
        roleSessionName:
          type: string
        secretAccessKey:
          type: string
        sessionToken:
          type: string
      type: object
    AttachBoundaryRequest:
      properties:
        policyId:
          format: uuid
          type: string
        userId:
          minLength: 1
          type: string
      required:
      - policyId
      - userId
      type: object
    AttachPolicyRequest:
      properties:
        principalId:
          minLength: 1
          type: string
        principalType:
          type: string
      required:
      - principalId
      type: object
    AttachRolePolicyRequest:
      properties:
        policyId:
          format: uuid
          type: string
      required:
      - policyId
      type: object
    AttachScpRequest:
      properties:
        scpId:
          format: uuid
          type: string
        targetId:
          format: uuid
          type: string
        targetType:
          minLength: 1
          type: string
      required:
      - scpId
      - targetId
      - targetType
      type: object
    AuthorizeRequest:
      properties:
        action:
          minLength: 1
          type: string
        context:
          additionalProperties: {}
          type: object
        principal:
          $ref: '#/components/schemas/Principal'
        resource:
          minLength: 1
          type: string
      required:
      - action
      - principal
      - resource
      type: object
    AuthorizeResponse:
      properties:
        decision:
          type: string
        evaluationTimeMs:
          format: int64
          type: integer
        matchedStatement:
          type: string
        reason:
          type: string
      type: object
    BatchAuthorizeRequest:
      properties:
        checks:
          items:
            $ref: '#/components/schemas/Check'
          minItems: 1
          type: array
        context:
          additionalProperties: {}
          type: object
        principal:
          $ref: '#/components/schemas/Principal'
      required:
      - checks
      - principal
      type: object
    BatchAuthorizeResponse:
      properties:
        results:
          items:
            $ref: '#/components/schemas/Result'
          type: array
      type: object
    BatchCreateOuRequest:
      properties:
        ous:
          items:
            $ref: '#/components/schemas/Item'
          maxItems: 500
          minItems: 0
          type: array
      required:
      - ous
      type: object
    BatchCreateOuResponse:
      properties:
        results:
          items:
            $ref: '#/components/schemas/Result'
          type: array
      type: object
    BatchProvisionRequest:
      properties:
        accounts:
          items:
            $ref: '#/components/schemas/Item'
          maxItems: 1000
          minItems: 0
          type: array
      required:
      - accounts
      type: object
    BatchProvisionResponse:
      properties:
        accepted:
          format: int32
          type: integer
        batchId:
          format: uuid
          type: string
        rejected:
          items:
            $ref: '#/components/schemas/Rejected'
          type: array
      type: object
    BatchProvisionStatusResponse:
      properties:
        batchId:
          format: uuid
          type: string
        completed:
          format: int32
          type: integer
        failed:
          format: int32
          type: integer
        items:
          items:
            $ref: '#/components/schemas/Item'
          type: array
        pending:
          format: int32
          type: integer
        total:
          format: int32
          type: integer
      type: object
    BrowserPolicyCheck:
      properties:
        action:
          type: string
        id:
          type: string
        resource:
          type: string
      type: object
    BrowserPolicyDecisionRequest:
      properties:
        checks:
          items:
            $ref: '#/components/schemas/BrowserPolicyCheck'
          type: array
      type: object
    BrowserPolicyDecisionResponse:
      properties:
        allowedIds:
          items:
            type: string
          type: array
      type: object
    Check:
      properties:
        action:
          minLength: 1
          type: string
        resource:
          minLength: 1
          type: string
      required:
      - action
      - resource
      type: object
    ClaimMapperDto:
      properties:
        claim:
          type: string
        userAttribute:
          type: string
      type: object
    ClientRegistryEntry:
      properties:
        baseUrlType:
          enum:
          - console_host
          - admin_console_host
          type: string
        clientId:
          type: string
        createdAt:
          format: date-time
          type: string
        deletedAt:
          format: date-time
          type: string
        description:
          type: string
        directAccessGrants:
          type: boolean
        displayName:
          type: string
        enabled:
          type: boolean
        id:
          format: uuid
          type: string
        ownerAccountId:
          format: uuid
          type: string
        publicClient:
          type: boolean
        realmTypes:
          enum:
          - all
          - acc
          - idc
          type: string
        redirectPath:
          type: string
        sortOrder:
          format: int32
          type: integer
        updatedAt:
          format: date-time
          type: string
      type: object
    ClientRegistrySyncResponse:
      properties:
        errors:
          items:
            type: string
          type: array
        realms_failed:
          format: int32
          type: integer
        realms_missing:
          items:
            type: string
          type: array
        realms_synced:
          format: int32
          type: integer
        realms_unclaimed:
          items:
            type: string
          type: array
      type: object
    CreateAccountAssignmentRequest:
      properties:
        accountId:
          format: uuid
          type: string
        groupId:
          format: uuid
          type: string
        permissionSetId:
          format: uuid
          type: string
      required:
      - accountId
      - groupId
      - permissionSetId
      type: object
    CreateAccountDelegationRequest:
      properties:
        delegateeAccountId:
          format: uuid
          type: string
        scopePermissionSetIds:
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
      required:
      - delegateeAccountId
      - scopePermissionSetIds
      type: object
    CreateAccountRequest:
      properties:
        description:
          type: string
        name:
          minLength: 1
          type: string
      required:
      - name
      type: object
    CreateClientRegistryRequest:
      properties:
        base_url_type:
          type: string
        client_id:
          minLength: 1
          pattern: ^[a-z][a-z0-9-]{1,62}$
          type: string
        description:
          type: string
        direct_access_grants:
          type: boolean
        display_name:
          minLength: 1
          type: string
        enabled:
          type: boolean
        owner_account_id:
          format: uuid
          type: string
        public_client:
          type: boolean
        realm_types:
          type: string
        redirect_path:
          type: string
        sort_order:
          format: int32
          type: integer
      required:
      - client_id
      - display_name
      type: object
    CreateCredentialRequest:
      properties:
        description:
          type: string
        expiresAt:
          format: date-time
          type: string
        principalId:
          minLength: 1
          type: string
        principalType:
          type: string
      required:
      - principalId
      type: object
    CreateCredentialResponse:
      properties:
        accessKeyId:
          type: string
        createdAt:
          format: date-time
          type: string
        description:
          type: string
        expiresAt:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        principalId:
          type: string
        secretKey:
          type: string
        status:
          type: string
      type: object
    CreateFederatedWorkloadIdentityRequest:
      properties:
        attributes:
          additionalProperties:
            type: string
          type: object
        issuer:
          minLength: 1
          type: string
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
        subject:
          minLength: 1
          type: string
      required:
      - issuer
      - name
      - subject
      type: object
    CreateGroupRequest:
      properties:
        description:
          type: string
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
      required:
      - name
      type: object
    CreateIamPolicyRequest:
      properties:
        description:
          type: string
        document:
          additionalProperties: {}
          type: object
        isManaged:
          type: boolean
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
        path:
          type: string
      required:
      - document
      - name
      type: object
    CreateIamUserRequest:
      properties:
        attributes:
          additionalProperties:
            type: string
          type: object
        boundaryPolicyId:
          format: uuid
          type: string
        email:
          format: email
          minLength: 1
          type: string
        firstName:
          type: string
        lastName:
          type: string
      required:
      - email
      type: object
    CreateIdcUserRequest:
      properties:
        attributes:
          additionalProperties:
            type: string
          type: object
        email:
          format: email
          minLength: 1
          type: string
        firstName:
          type: string
        lastName:
          type: string
      required:
      - email
      type: object
    CreateInlinePolicyRequest:
      properties:
        document:
          additionalProperties: {}
          type: object
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
        principalId:
          minLength: 1
          type: string
        principalType:
          type: string
      required:
      - document
      - name
      - principalId
      type: object
    CreateOrganizationRequest:
      properties:
        description:
          type: string
        name:
          minLength: 1
          type: string
      required:
      - name
      type: object
    CreateOuAssignmentRequest:
      properties:
        groupId:
          format: uuid
          type: string
        permissionSetId:
          format: uuid
          type: string
      required:
      - groupId
      - permissionSetId
      type: object
    CreateOuDelegationRequest:
      properties:
        delegateeAccountId:
          format: uuid
          type: string
        delegatorOuId:
          format: uuid
          type: string
        scopePermissionSetIds:
          items:
            format: uuid
            type: string
          minItems: 1
          type: array
      required:
      - delegateeAccountId
      - delegatorOuId
      - scopePermissionSetIds
      type: object
    CreateOuRequest:
      properties:
        name:
          minLength: 1
          type: string
        parentId:
          format: uuid
          type: string
      required:
      - name
      - parentId
      type: object
    CreateOwnAccessKeyRequest:
      properties:
        description:
          type: string
        expiresAt:
          format: date-time
          type: string
      type: object
    CreatePlatformOrganizationRequest:
      properties:
        description:
          type: string
        management_account_id:
          format: uuid
          type: string
        name:
          minLength: 1
          type: string
      required:
      - management_account_id
      - name
      type: object
    CreatePolicySetRequest:
      properties:
        description:
          type: string
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
      required:
      - name
      type: object
    CreateQuotaIncreaseRequest:
      properties:
        quotaId:
          format: uuid
          type: string
        reason:
          type: string
        requestedValue:
          format: int32
          type: integer
      required:
      - quotaId
      type: object
    CreateResourcePolicyRequest:
      properties:
        document:
          additionalProperties: {}
          type: object
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
        resourceFrn:
          minLength: 1
          type: string
      required:
      - document
      - name
      - resourceFrn
      type: object
    CreateRoleRequest:
      properties:
        description:
          type: string
        maxSessionDuration:
          format: int32
          type: integer
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
        path:
          type: string
        trustPolicy:
          additionalProperties: {}
          type: object
      required:
      - name
      - trustPolicy
      type: object
    CreateScpRequest:
      properties:
        description:
          type: string
        document:
          additionalProperties: {}
          type: object
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
      required:
      - document
      - name
      type: object
    CreateServiceUserRequest:
      properties:
        attributes:
          additionalProperties:
            type: string
          type: object
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
        principalType:
          type: string
      required:
      - name
      type: object
    CreateTestUserRequest:
      properties:
        email:
          type: string
        user_type:
          type: string
      type: object
    CreateTestUserResponse:
      properties:
        access_token:
          type: string
        email:
          type: string
        expires_in:
          format: int64
          type: integer
        user_id:
          type: string
      type: object
    CreateTrustPolicyRequest:
      properties:
        conditions:
          additionalProperties: {}
          type: object
        expiresAt:
          format: date-time
          type: string
        grantedActions:
          items:
            type: string
          minItems: 1
          type: array
        serviceNamespace:
          minLength: 1
          type: string
        sourceAccountId:
          format: uuid
          type: string
        sourcePrincipalFrn:
          type: string
        targetResourceFrn:
          minLength: 1
          type: string
      required:
      - grantedActions
      - serviceNamespace
      - targetResourceFrn
      type: object
    CredentialRepresentation:
      properties:
        algorithm:
          deprecated: true
          type: string
        config:
          additionalProperties:
            deprecated: true
            items:
              deprecated: true
              type: string
            type: array
          deprecated: true
          properties:
            empty:
              type: boolean
          type: object
        counter:
          deprecated: true
          format: int32
          type: integer
        createdDate:
          format: int64
          type: integer
        credentialData:
          type: string
        device:
          deprecated: true
          type: string
        digits:
          deprecated: true
          format: int32
          type: integer
        federationLink:
          type: string
        hashIterations:
          deprecated: true
          format: int32
          type: integer
        hashedSaltedValue:
          deprecated: true
          type: string
        id:
          type: string
        period:
          deprecated: true
          format: int32
          type: integer
        priority:
          format: int32
          type: integer
        salt:
          deprecated: true
          type: string
        secretData:
          type: string
        temporary:
          type: boolean
        type:
          type: string
        userLabel:
          type: string
        value:
          type: string
      type: object
    CredentialSummary:
      properties:
        accessKeyId:
          type: string
        accountId:
          format: uuid
          type: string
        createdAt:
          format: date-time
          type: string
        description:
          type: string
        expiresAt:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        lastUsedAt:
          format: date-time
          type: string
        permissionSetId:
          format: uuid
          type: string
        principalId:
          type: string
        principalType:
          type: string
        status:
          type: string
      type: object
    DelegatedAdministrator:
      properties:
        accountId:
          format: uuid
          type: string
        boundaryPolicyId:
          format: uuid
          type: string
        createdAt:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        organizationId:
          format: uuid
          type: string
        parentDelegateId:
          format: uuid
          type: string
        principalSub:
          type: string
        serviceName:
          type: string
      type: object
    DenyQuotaRequest:
      properties:
        decisionReason:
          minLength: 1
          type: string
      required:
      - decisionReason
      type: object
    DeveloperCredentialMetadata:
      properties:
        client_id:
          type: string
        redirect_uris:
          items:
            type: string
          type: array
        scopes:
          items:
            type: string
          type: array
        token_endpoint_auth_method:
          type: string
      type: object
    DeveloperCredentialSecret:
      properties:
        client_id:
          type: string
        client_secret:
          type: string
      type: object
    DeveloperServiceRequest:
      properties:
        description:
          type: string
        direct_access_grants:
          type: boolean
        display_name:
          minLength: 1
          type: string
        pkce:
          type: string
        public_client:
          type: boolean
        redirect_uris:
          items:
            type: string
          type: array
        scopes:
          items:
            type: string
          type: array
        service_id:
          minLength: 1
          type: string
        surfaces:
          additionalProperties: {}
          type: object
        token_endpoint_auth_method:
          type: string
        verified_domains:
          items:
            type: string
          type: array
        version:
          minLength: 1
          type: string
      required:
      - display_name
      - service_id
      - surfaces
      - version
      type: object
    DeveloperServiceResponse:
      properties:
        client_id:
          type: string
        client_secret:
          type: string
        description:
          type: string
        display_name:
          type: string
        idempotent:
          type: boolean
        links:
          additionalProperties:
            type: string
          type: object
        manifest_id:
          format: uuid
          type: string
        redirect_uris:
          items:
            type: string
          type: array
        scopes:
          items:
            type: string
          type: array
        service_id:
          type: string
        state:
          enum:
          - DRAFT
          - VALIDATED
          - REGISTERED
          - PROVISIONED
          - ACTIVE
          - FAILED
          - RETIRED
          type: string
        token_endpoint_auth_method:
          type: string
        version:
          type: string
      type: object
    EffectivePolicy:
      properties:
        allowedMethods:
          items:
            type: string
          type: array
        canManageOrganizationPolicy:
          type: boolean
        gracePeriodDays:
          format: int32
          type: integer
        identityKind:
          type: string
        organizationConfigurable:
          type: boolean
        passwordManagedExternally:
          type: boolean
        promptMode:
          type: string
        provider:
          type: string
        source:
          type: string
        unenrolledBehavior:
          type: string
      type: object
    Error:
      properties:
        code:
          type: string
        message:
          type: string
      type: object
    ExpiringAccessKeyDto:
      properties:
        accessKeyId:
          type: string
        createdAt:
          format: date-time
          type: string
        expiresAt:
          format: date-time
          type: string
        lastUsedAt:
          format: date-time
          type: string
        principalId:
          type: string
        principalType:
          type: string
        status:
          type: string
      type: object
    ExpiringAccessKeysResponse:
      properties:
        items:
          items:
            $ref: '#/components/schemas/ExpiringAccessKeyDto'
          type: array
        page:
          format: int32
          type: integer
        pageSize:
          format: int32
          type: integer
        totalCount:
          format: int32
          type: integer
      type: object
    FactorState:
      properties:
        addedAt:
          format: date-time
          type: string
        enrolled:
          type: boolean
        lastUsedAt:
          format: date-time
          type: string
        userLabel:
          type: string
      type: object
    FederatedIdentityRepresentation:
      properties:
        identityProvider:
          type: string
        userId:
          type: string
        userName:
          type: string
      type: object
    FederationIdentityProviderDto:
      properties:
        alias:
          type: string
        audience:
          type: string
        claimMappers:
          items:
            $ref: '#/components/schemas/ClaimMapperDto'
          type: array
        issuer:
          type: string
        jwksUri:
          type: string
      type: object
    GatewayRouteResponse:
      properties:
        backend_prefix:
          type: string
        browser_prefix:
          type: string
        service_id:
          type: string
        upstream:
          $ref: '#/components/schemas/GatewayUpstreamResponse'
        version:
          type: string
      type: object
    GatewayRoutesResponse:
      properties:
        generated_at:
          format: date-time
          type: string
        revision:
          type: string
        routes:
          items:
            $ref: '#/components/schemas/GatewayRouteResponse'
          type: array
        shell:
          type: string
      type: object
    GatewayUpstreamResponse:
      properties:
        kind:
          type: string
        namespace:
          type: string
        port:
          format: int32
          type: integer
        service:
          type: string
      type: object
    GetSessionTokenRequest:
      properties:
        accountId:
          format: uuid
          type: string
        durationSeconds:
          format: int32
          maximum: 43200
          minimum: 1
          type: integer
        permissionSetId:
          format: uuid
          type: string
      required:
      - accountId
      - permissionSetId
      type: object
    GetSessionTokenResponse:
      properties:
        accessKeyId:
          type: string
        accountId:
          format: uuid
          type: string
        copyNotice:
          type: string
        credentialsFile:
          type: string
        durationSeconds:
          format: int32
          type: integer
        environmentVariables:
          type: string
        expiration:
          format: date-time
          type: string
        json:
          type: string
        permissionSetId:
          format: uuid
          type: string
        secretKey:
          type: string
        sessionToken:
          type: string
      type: object
    Group:
      properties:
        createdAt:
          format: date-time
          type: string
        description:
          type: string
        id:
          format: uuid
          type: string
        name:
          type: string
        organizationId:
          format: uuid
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    GroupMember:
      properties:
        addedAt:
          format: date-time
          type: string
        groupId:
          format: uuid
          type: string
        principalId:
          type: string
        principalType:
          type: string
      type: object
    HardwareKeyInfo:
      properties:
        attestationType:
          type: string
        createdAt:
          format: date-time
          type: string
        credentialId:
          deprecated: true
          type: string
        label:
          type: string
        lastUsed:
          format: date-time
          type: string
      type: object
    IamInlinePolicy:
      properties:
        accountId:
          format: uuid
          type: string
        createdAt:
          format: date-time
          type: string
        document:
          additionalProperties: {}
          type: object
        id:
          format: uuid
          type: string
        name:
          type: string
        principalId:
          type: string
        principalType:
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    IamPolicy:
      properties:
        accountId:
          format: uuid
          type: string
        attachability:
          enum:
          - STANDARD
          - BOUNDARY_WORKFLOW
          - INTERNAL_LIFECYCLE
          - NONE
          type: string
        audience:
          enum:
          - TENANT_ASSIGNABLE
          - PLATFORM_ADMIN_ASSIGNABLE
          - WORKFLOW_ONLY
          - INTERNAL_ONLY
          type: string
        authoredAt:
          format: date-time
          type: string
        authoredBySub:
          type: string
        createdAt:
          format: date-time
          type: string
        declaringOwner:
          type: string
        description:
          type: string
        document:
          additionalProperties: {}
          type: object
        id:
          format: uuid
          type: string
        kind:
          enum:
          - PERMISSION
          - BOUNDARY
          - SYSTEM
          type: string
        managed:
          type: boolean
        maxVersions:
          format: int32
          type: integer
        name:
          type: string
        path:
          type: string
        provenance:
          enum:
          - PLATFORM_MANAGED
          - SERVICE_MANAGED
          - CUSTOMER_MANAGED
          - SYSTEM_GENERATED
          type: string
        publishedAt:
          format: date-time
          type: string
        publishedBySub:
          type: string
        scope:
          enum:
          - PLATFORM_CATALOG
          - PLATFORM_ASSIGNMENT
          - ORGANIZATION
          - ACCOUNT
          - RESOURCE
          - PRINCIPAL
          - ROLE
          type: string
        state:
          enum:
          - DRAFT
          - PUBLISHED
          type: string
        updatedAt:
          format: date-time
          type: string
        version:
          format: int32
          type: integer
      type: object
    IamPolicyAttachment:
      properties:
        accountId:
          format: uuid
          type: string
        attachedAt:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        policyId:
          format: uuid
          type: string
        principalId:
          type: string
        principalType:
          type: string
      type: object
    IamPolicyVersion:
      properties:
        createdAt:
          format: date-time
          type: string
        default:
          type: boolean
        description:
          type: string
        document:
          additionalProperties: {}
          type: object
        id:
          format: uuid
          type: string
        policyId:
          format: uuid
          type: string
        versionNumber:
          format: int32
          type: integer
      type: object
    IamRole:
      properties:
        accountId:
          format: uuid
          type: string
        createdAt:
          format: date-time
          type: string
        description:
          type: string
        id:
          format: uuid
          type: string
        maxSessionDuration:
          format: int32
          type: integer
        name:
          type: string
        path:
          type: string
        trustPolicy:
          additionalProperties: {}
          type: object
        updatedAt:
          format: date-time
          type: string
        version:
          format: int32
          type: integer
      type: object
    IamUserDto:
      properties:
        attributes:
          additionalProperties:
            items:
              type: string
            type: array
          type: object
        created_timestamp:
          format: int64
          type: integer
        email:
          type: string
        email_verified:
          type: boolean
        enabled:
          type: boolean
        first_name:
          type: string
        id:
          type: string
        last_name:
          type: string
        principal_type:
          type: string
        username:
          type: string
      type: object
    IdcUserActivationResponse:
      properties:
        activated_at:
          format: date-time
          type: string
        delivery:
          type: string
        email_verified:
          type: boolean
        expires_at:
          format: date-time
          type: string
        failure_code:
          type: string
        issued_at:
          format: date-time
          type: string
        state:
          type: string
        user_id:
          type: string
      type: object
    IdcUserSecurityResponse:
      properties:
        allowed_methods:
          items:
            type: string
          type: array
        compromised_password_screening:
          $ref: '#/components/schemas/PasswordScreening'
        effective_password_policy:
          type: string
        enrollment_required:
          type: boolean
        mfa_administration_available:
          type: boolean
        mfa_devices:
          items:
            $ref: '#/components/schemas/MfaDevice'
          type: array
        password_reset_available:
          type: boolean
        source:
          type: string
        source_provider_name:
          type: string
        user_id:
          type: string
      type: object
    InspectWorkforceInviteRequest:
      properties:
        token:
          minLength: 1
          type: string
      required:
      - token
      type: object
    InstallRequest:
      properties:
        account_ids:
          items:
            format: uuid
            type: string
          type: array
        group_id:
          format: uuid
          type: string
        service_id:
          minLength: 1
          type: string
      required:
      - service_id
      type: object
    InstallationResponse:
      properties:
        idempotent:
          type: boolean
        installation_id:
          format: uuid
          type: string
        scope_id:
          format: uuid
          type: string
        scope_type:
          enum:
          - ACCOUNT
          - ORGANIZATION
          type: string
        service_id:
          type: string
        status:
          enum:
          - ACTIVE
          - REMOVED
          type: string
        version:
          type: string
      type: object
    IssueWorkforceInviteRequest:
      properties:
        assignments:
          items:
            $ref: '#/components/schemas/WorkforceInviteAssignmentRequest'
          minItems: 1
          type: array
        email:
          format: email
          minLength: 1
          type: string
        organizationId:
          format: uuid
          type: string
      required:
      - assignments
      - email
      - organizationId
      type: object
    IssuedOneTimePasswordResponse:
      properties:
        one_time_password:
          type: string
        sign_in_path:
          type: string
        temporary:
          type: boolean
      type: object
    IssuedWorkforceInviteResponse:
      properties:
        invite:
          $ref: '#/components/schemas/WorkforceInviteResponse'
        token:
          type: string
      type: object
    Item:
      properties:
        clientRef:
          minLength: 1
          type: string
        name:
          minLength: 1
          type: string
        parentRef:
          minLength: 1
          type: string
      required:
      - clientRef
      - name
      - parentRef
      type: object
    ManagedPermissionSetDefinition:
      properties:
        assignment_scope:
          type: string
        description:
          type: string
        name:
          minLength: 1
          type: string
        platformScope:
          type: boolean
        platform_admin_default:
          type: boolean
        policy_names:
          items:
            minLength: 1
            type: string
          minItems: 1
          type: array
      required:
      - name
      - policy_names
      type: object
    ManagedPolicyDefinition:
      properties:
        description:
          type: string
        name:
          minLength: 1
          type: string
        statements:
          items:
            $ref: '#/components/schemas/StatementDefinition'
          minItems: 1
          type: array
      required:
      - name
      - statements
      type: object
    ManagedScpDefinition:
      properties:
        description:
          type: string
        name:
          minLength: 1
          type: string
        statements:
          items:
            $ref: '#/components/schemas/StatementDefinition'
          minItems: 1
          type: array
      required:
      - name
      - statements
      type: object
    MeResponse:
      properties:
        canManageOrg:
          type: boolean
      type: object
    MfaDevice:
      properties:
        created_at:
          format: int64
          type: integer
        display_name:
          type: string
        id:
          type: string
        method:
          type: string
      type: object
    MfaFactors:
      properties:
        totp:
          $ref: '#/components/schemas/FactorState'
        webauthn:
          $ref: '#/components/schemas/FactorState'
      type: object
    MfaPolicy:
      properties:
        allowedMethods:
          items:
            type: string
          type: array
        canManageOrganizationPolicy:
          type: boolean
        gracePeriodDays:
          format: int32
          type: integer
        hardwareKeyAttachment:
          type: string
        identityKind:
          type: string
        mfaRequired:
          type: boolean
        organizationConfigurable:
          type: boolean
        passwordManagedExternally:
          type: boolean
        promptMode:
          type: string
        provider:
          type: string
        realm:
          type: string
        requireHardwareKey:
          type: boolean
        requireTotp:
          type: boolean
        source:
          type: string
        unenrolledBehavior:
          type: string
      type: object
    MoveAccountRequest:
      properties:
        targetOuId:
          format: uuid
          type: string
      required:
      - targetOuId
      type: object
    NotificationPrefs:
      properties:
        categories:
          additionalProperties:
            type: boolean
          type: object
        email:
          type: boolean
        globalMute:
          type: boolean
        quietHours:
          $ref: '#/components/schemas/NotificationPrefsQuietHours'
      required:
      - categories
      - email
      - globalMute
      type: 'null'
    NotificationPrefsQuietHours:
      properties:
        end:
          type: string
        start:
          type: string
        tz:
          type: string
      required:
      - end
      - start
      - tz
      type: 'null'
    OrgServiceDelegationResponse:
      properties:
        delegatedAdminAccountId:
          format: uuid
          type: string
        designatedAt:
          format: date-time
          type: string
        designatedBySub:
          type: string
        orgId:
          format: uuid
          type: string
        serviceName:
          type: string
        updatedAt:
          format: date-time
          type: string
        updatedBySub:
          type: string
      type: object
    OrgSubtreeMembershipCheck:
      properties:
        accountId:
          format: uuid
          type: string
        clientRef:
          maxLength: 128
          minLength: 0
          type: string
        organizationId:
          format: uuid
          type: string
        subtreeOuId:
          format: uuid
          type: string
      required:
      - accountId
      - clientRef
      - organizationId
      - subtreeOuId
      type: object
    OrgSubtreeMembershipCheckRequest:
      properties:
        checks:
          items:
            $ref: '#/components/schemas/OrgSubtreeMembershipCheck'
          maxItems: 500
          minItems: 0
          type: array
      required:
      - checks
      type: object
    OrgSubtreeMembershipCheckResponse:
      properties:
        results:
          items:
            $ref: '#/components/schemas/OrgSubtreeMembershipResult'
          type: array
      type: object
    OrgSubtreeMembershipResult:
      properties:
        accountId:
          format: uuid
          type: string
        activeMember:
          type: boolean
        clientRef:
          type: string
        organizationId:
          format: uuid
          type: string
        subtreeOuId:
          format: uuid
          type: string
      type: object
    OrgTreeAccount:
      properties:
        id:
          format: uuid
          type: string
        name:
          type: string
      type: object
    Organization:
      properties:
        createdAt:
          format: date-time
          type: string
        description:
          type: string
        id:
          format: uuid
          type: string
        idcRealmName:
          type: string
        maxActiveCredentials:
          format: int32
          type: integer
        mgmtAccountId:
          format: uuid
          type: string
        name:
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    OrganizationalUnit:
      properties:
        createdAt:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        name:
          type: string
        organizationId:
          format: uuid
          type: string
        parentId:
          format: uuid
          type: string
        path:
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    OuAssignmentResponse:
      properties:
        createdAt:
          format: date-time
          type: string
        groupId:
          format: uuid
          type: string
        id:
          format: uuid
          type: string
        orgId:
          format: uuid
          type: string
        ouId:
          format: uuid
          type: string
        permissionSetId:
          format: uuid
          type: string
      type: object
    OuSummary:
      properties:
        childCount:
          format: int64
          type: integer
        hasChildren:
          type: boolean
        id:
          format: uuid
          type: string
        name:
          type: string
        parentId:
          format: uuid
          type: string
        path:
          type: string
      type: object
    OuTreeNode:
      properties:
        accounts:
          items:
            $ref: '#/components/schemas/OrgTreeAccount'
          type: array
        children:
          items:
            $ref: '#/components/schemas/OuTreeNode'
          type: array
        id:
          format: uuid
          type: string
        name:
          type: string
        parentId:
          format: uuid
          type: string
        path:
          type: string
      type: object
    PageAccount:
      properties:
        content:
          items:
            $ref: '#/components/schemas/Account'
          type: array
        empty:
          type: boolean
        first:
          type: boolean
        last:
          type: boolean
        number:
          format: int32
          type: integer
        numberOfElements:
          format: int32
          type: integer
        pageable:
          $ref: '#/components/schemas/PageableObject2'
        size:
          format: int32
          type: integer
        sort:
          $ref: '#/components/schemas/SortObject2'
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PageAccountAssignment:
      properties:
        content:
          items:
            $ref: '#/components/schemas/AccountAssignment'
          type: array
        empty:
          type: boolean
        first:
          type: boolean
        last:
          type: boolean
        number:
          format: int32
          type: integer
        numberOfElements:
          format: int32
          type: integer
        pageable:
          $ref: '#/components/schemas/PageableObject2'
        size:
          format: int32
          type: integer
        sort:
          $ref: '#/components/schemas/SortObject2'
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PageGroup:
      properties:
        content:
          items:
            $ref: '#/components/schemas/Group'
          type: array
        empty:
          type: boolean
        first:
          type: boolean
        last:
          type: boolean
        number:
          format: int32
          type: integer
        numberOfElements:
          format: int32
          type: integer
        pageable:
          $ref: '#/components/schemas/PageableObject2'
        size:
          format: int32
          type: integer
        sort:
          $ref: '#/components/schemas/SortObject2'
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PageIamUserDto:
      properties:
        content:
          items:
            $ref: '#/components/schemas/IamUserDto'
          type: array
        empty:
          type: boolean
        first:
          type: boolean
        last:
          type: boolean
        number:
          format: int32
          type: integer
        numberOfElements:
          format: int32
          type: integer
        pageable:
          $ref: '#/components/schemas/PageableObject2'
        size:
          format: int32
          type: integer
        sort:
          $ref: '#/components/schemas/SortObject2'
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PageOrganization:
      properties:
        content:
          items:
            $ref: '#/components/schemas/Organization'
          type: array
        empty:
          type: boolean
        first:
          type: boolean
        last:
          type: boolean
        number:
          format: int32
          type: integer
        numberOfElements:
          format: int32
          type: integer
        pageable:
          $ref: '#/components/schemas/PageableObject2'
        size:
          format: int32
          type: integer
        sort:
          $ref: '#/components/schemas/SortObject2'
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PageOuSummary:
      properties:
        content:
          items:
            $ref: '#/components/schemas/OuSummary'
          type: array
        empty:
          type: boolean
        first:
          type: boolean
        last:
          type: boolean
        number:
          format: int32
          type: integer
        numberOfElements:
          format: int32
          type: integer
        pageable:
          $ref: '#/components/schemas/PageableObject2'
        size:
          format: int32
          type: integer
        sort:
          $ref: '#/components/schemas/SortObject2'
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PagePolicySet:
      properties:
        content:
          items:
            $ref: '#/components/schemas/PolicySet'
          type: array
        empty:
          type: boolean
        first:
          type: boolean
        last:
          type: boolean
        number:
          format: int32
          type: integer
        numberOfElements:
          format: int32
          type: integer
        pageable:
          $ref: '#/components/schemas/PageableObject2'
        size:
          format: int32
          type: integer
        sort:
          $ref: '#/components/schemas/SortObject2'
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PageQuotaIncreaseRequest:
      properties:
        content:
          items:
            $ref: '#/components/schemas/QuotaIncreaseRequest'
          type: array
        empty:
          type: boolean
        first:
          type: boolean
        last:
          type: boolean
        number:
          format: int32
          type: integer
        numberOfElements:
          format: int32
          type: integer
        pageable:
          $ref: '#/components/schemas/PageableObject2'
        size:
          format: int32
          type: integer
        sort:
          $ref: '#/components/schemas/SortObject2'
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PageUserRepresentation:
      properties:
        content:
          items:
            $ref: '#/components/schemas/UserRepresentation'
          type: array
        empty:
          type: boolean
        first:
          type: boolean
        last:
          type: boolean
        number:
          format: int32
          type: integer
        numberOfElements:
          format: int32
          type: integer
        pageable:
          $ref: '#/components/schemas/PageableObject2'
        size:
          format: int32
          type: integer
        sort:
          $ref: '#/components/schemas/SortObject2'
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PageableObject2:
      properties:
        offset:
          format: int64
          type: integer
        pageNumber:
          format: int32
          type: integer
        pageSize:
          format: int32
          type: integer
        paged:
          type: boolean
        sort:
          $ref: '#/components/schemas/SortObject2'
        unpaged:
          type: boolean
      type: object
    PasswordScreening:
      properties:
        corpus_version:
          type: string
        enabled:
          type: boolean
        lookup_mode:
          type: string
        outage_behavior:
          type: string
        source:
          type: string
      type: object
    PermissionBoundary:
      properties:
        accountId:
          format: uuid
          type: string
        id:
          format: uuid
          type: string
        policyId:
          format: uuid
          type: string
        setAt:
          format: date-time
          type: string
        userId:
          type: string
      type: object
    PermissionSetCustomerPolicyRef:
      properties:
        createdAt:
          format: date-time
          type: string
        permissionSetId:
          format: uuid
          type: string
        policyName:
          type: string
      type: object
    PermissionSetDefault:
      properties:
        permission_set_names:
          items:
            minLength: 1
            type: string
          minItems: 1
          type: array
      required:
      - permission_set_names
      type: object
    Plan:
      properties:
        createdAt:
          format: date-time
          type: string
        featureFlags:
          items:
            type: string
          type: array
          uniqueItems: true
        id:
          format: uuid
          type: string
        name:
          type: string
        quotas:
          additionalProperties:
            format: int64
            type: integer
          type: object
        tier:
          enum:
          - free
          - standard
          - enterprise
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    PlatformOrganizationListResponse:
      properties:
        items:
          items:
            $ref: '#/components/schemas/PlatformOrganizationSummary'
          type: array
        total:
          format: int32
          type: integer
      type: object
    PlatformOrganizationSummary:
      properties:
        account_id:
          format: uuid
          type: string
        account_name:
          type: string
        accounts_count:
          format: int32
          type: integer
        created_at:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        name:
          type: string
        parent_id:
          format: uuid
          type: string
        updated_at:
          format: date-time
          type: string
      type: object
    PolicyAttachmentResponse:
      properties:
        attachability:
          enum:
          - STANDARD
          - BOUNDARY_WORKFLOW
          - INTERNAL_LIFECYCLE
          - NONE
          type: string
        audience:
          enum:
          - TENANT_ASSIGNABLE
          - PLATFORM_ADMIN_ASSIGNABLE
          - WORKFLOW_ONLY
          - INTERNAL_ONLY
          type: string
        category:
          enum:
          - PERMISSION
          - BOUNDARY
          - SYSTEM
          type: string
        declaringOwner:
          type: string
        description:
          type: string
        id:
          format: uuid
          type: string
        isManaged:
          type: boolean
        name:
          type: string
        provenance:
          enum:
          - PLATFORM_MANAGED
          - SERVICE_MANAGED
          - CUSTOMER_MANAGED
          - SYSTEM_GENERATED
          type: string
        scope:
          enum:
          - PLATFORM_CATALOG
          - PLATFORM_ASSIGNMENT
          - ORGANIZATION
          - ACCOUNT
          - RESOURCE
          - PRINCIPAL
          - ROLE
          type: string
        state:
          enum:
          - DRAFT
          - PUBLISHED
          type: string
      type: object
    PolicyChange:
      properties:
        account_id:
          format: uuid
          type: string
        policy_id:
          format: uuid
          type: string
        policy_name:
          type: string
        rewrites:
          additionalProperties:
            format: int32
            type: integer
          type: object
        rewritten_action_count:
          format: int32
          type: integer
      type: object
    PolicyDefault:
      properties:
        policy_names:
          items:
            minLength: 1
            type: string
          minItems: 1
          type: array
      required:
      - policy_names
      type: object
    PolicySet:
      properties:
        attachability:
          enum:
          - ACCOUNT_ASSIGNMENT
          - PLATFORM_ASSIGNMENT
          - NONE
          type: string
        audience:
          enum:
          - TENANT_ASSIGNABLE
          - PLATFORM_ADMIN_ASSIGNABLE
          - WORKFLOW_ONLY
          - INTERNAL_ONLY
          type: string
        category:
          enum:
          - PLATFORM_BASELINE
          - PRODUCT_ACCESS
          - PLATFORM_OPERATOR
          - CUSTOMER_CUSTOM
          type: string
        createdAt:
          format: date-time
          type: string
        declaringOwner:
          type: string
        description:
          type: string
        id:
          format: uuid
          type: string
        is_managed:
          type: boolean
        managed:
          type: boolean
        name:
          type: string
        organizationId:
          format: uuid
          type: string
        provenance:
          enum:
          - PLATFORM_MANAGED
          - SERVICE_MANAGED
          - CUSTOMER_MANAGED
          - SYSTEM_GENERATED
          type: string
        scope:
          enum:
          - PLATFORM_CATALOG
          - PLATFORM_ASSIGNMENT
          - ORGANIZATION
          - ACCOUNT
          - RESOURCE
          - PRINCIPAL
          - ROLE
          type: string
        state:
          enum:
          - DRAFT
          - PUBLISHED
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    PolicyVersion:
      properties:
        id:
          format: int32
          type: integer
        updatedAt:
          format: date-time
          type: string
        version:
          format: int64
          type: integer
      type: object
    PortalAccountResponse:
      properties:
        accountId:
          type: string
        accountName:
          type: string
        policySets:
          items:
            type: string
          type: array
        realmName:
          type: string
        role:
          type: string
      type: object
    PortalOrganizationResponse:
      properties:
        accountCount:
          format: int32
          type: integer
        id:
          type: string
        name:
          type: string
        slug:
          type: string
      type: object
    Principal:
      properties:
        accountId:
          minLength: 1
          type: string
        icSession:
          type: boolean
        psId:
          type: string
        userId:
          minLength: 1
          type: string
        userType:
          minLength: 1
          type: string
      required:
      - accountId
      - userId
      - userType
      type: object
    ProfileMfaStatus:
      properties:
        factors:
          $ref: '#/components/schemas/MfaFactors'
        policy:
          $ref: '#/components/schemas/MfaPolicy'
      type: object
    ProvisionMemberAccountRequest:
      properties:
        accountName:
          minLength: 1
          type: string
        email:
          format: email
          minLength: 1
          type: string
        ouId:
          format: uuid
          type: string
      required:
      - accountName
      - email
      - ouId
      type: object
    ProvisioningDefaults:
      properties:
        account_root:
          $ref: '#/components/schemas/PolicyDefault'
        service_users:
          $ref: '#/components/schemas/PolicyDefault'
        workforce:
          $ref: '#/components/schemas/PermissionSetDefault'
        workload_identities:
          $ref: '#/components/schemas/PolicyDefault'
      type: object
    ProvisioningJobResponse:
      properties:
        accountId:
          format: uuid
          type: string
        completedSteps:
          items:
            type: string
          type: array
        createdAt:
          format: date-time
          type: string
        currentStep:
          type: string
        email:
          type: string
        errorMessage:
          type: string
        id:
          format: uuid
          type: string
        retryCount:
          format: int32
          type: integer
        status:
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    ProvisioningJobSummary:
      properties:
        createdAt:
          format: date-time
          type: string
        currentStep:
          type: string
        errorMessage:
          type: string
        errorStep:
          type: string
        id:
          format: uuid
          type: string
        status:
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    ProvisioningStatusResponse:
      properties:
        accountName:
          type: string
        completedSteps:
          items:
            type: string
          type: array
        createdAt:
          format: date-time
          type: string
        currentStep:
          type: string
        errorMessage:
          type: string
        provisioningStatus:
          type: string
        refusalReason:
          type: string
        registrationId:
          format: uuid
          type: string
        registrationStatus:
          type: string
        totalSteps:
          format: int32
          type: integer
      type: object
    PublishedServiceResponse:
      properties:
        description:
          type: string
        display_name:
          type: string
        links:
          additionalProperties:
            type: string
          type: object
        provisioning_defaults:
          additionalProperties: {}
          type: object
        service_id:
          type: string
        version:
          type: string
      type: object
    QuotaIncreaseRequest:
      properties:
        createdAt:
          format: date-time
          type: string
        currentValue:
          format: int32
          type: integer
        decidedAt:
          format: date-time
          type: string
        decidedBy:
          type: string
        decisionReason:
          type: string
        id:
          format: uuid
          type: string
        leaveRequestAccountId:
          format: uuid
          type: string
        organizationId:
          format: uuid
          type: string
        quotaId:
          format: uuid
          type: string
        reason:
          type: string
        requestedValue:
          format: int32
          type: integer
        requesterId:
          type: string
        status:
          enum:
          - PENDING
          - APPROVED
          - DENIED
          - CANCELLED
          type: string
      type: object
    QuotaScopesResponse:
      properties:
        scope:
          type: string
        scopes:
          items:
            $ref: '#/components/schemas/ScopeOption'
          type: array
      type: object
    QuotaThresholdListResponse:
      properties:
        items:
          items:
            $ref: '#/components/schemas/QuotaThresholdView'
          type: array
      type: object
    QuotaThresholdRequest:
      properties:
        accountId:
          format: uuid
          type: string
        dangerPct:
          format: int32
          maximum: 100
          minimum: 1
          type: integer
        enabled:
          type: boolean
        quotaCode:
          minLength: 1
          type: string
        serviceCode:
          minLength: 1
          type: string
        warnPct:
          format: int32
          maximum: 99
          minimum: 1
          type: integer
      required:
      - quotaCode
      - serviceCode
      type: object
    QuotaThresholdView:
      properties:
        accountId:
          format: uuid
          type: string
        dangerPct:
          format: int32
          type: integer
        enabled:
          type: boolean
        ownerUserId:
          format: uuid
          type: string
        quotaCode:
          type: string
        quotaId:
          type: string
        serviceCode:
          type: string
        warnPct:
          format: int32
          type: integer
      type: object
    RealmDiscoveryRequest:
      properties:
        email:
          format: email
          minLength: 1
          type: string
        type:
          type: string
      required:
      - email
      type: object
    RealmDiscoveryResponse:
      properties:
        issuer:
          type: string
        otpRequired:
          type: boolean
        realm:
          type: string
      type: object
    RecordAuditEventRequest:
      properties:
        accountId:
          format: uuid
          type: string
        actorId:
          maxLength: 255
          minLength: 0
          type: string
        actorType:
          maxLength: 10
          minLength: 0
          pattern: root|iam|ic|client
          type: string
        correlationId:
          maxLength: 128
          minLength: 0
          type: string
        errorCode:
          maxLength: 64
          minLength: 0
          type: string
        eventCategory:
          maxLength: 16
          minLength: 0
          pattern: management|data
          type: string
        eventId:
          format: uuid
          type: string
        eventName:
          maxLength: 128
          minLength: 0
          type: string
        eventSource:
          maxLength: 64
          minLength: 0
          type: string
        occurredAt:
          format: date-time
          type: string
        request:
          additionalProperties: {}
          type: object
        resourceFrn:
          maxLength: 255
          minLength: 0
          type: string
        response:
          additionalProperties: {}
          type: object
        sourceIp:
          type: string
      required:
      - accountId
      - eventId
      - eventName
      - eventSource
      type: object
    RegisterActionRequest:
      properties:
        description:
          type: string
        name:
          minLength: 1
          pattern: ^[A-Za-z][A-Za-z0-9_-]{0,126}$
          type: string
      required:
      - name
      type: object
    RegisterNamespaceRequest:
      properties:
        actions:
          items:
            $ref: '#/components/schemas/ActionDefinition'
          type: array
        description:
          type: string
        namespace:
          minLength: 1
          pattern: ^[a-z][a-z0-9_-]{1,62}$
          type: string
        service_name:
          minLength: 1
          type: string
      required:
      - namespace
      - service_name
      type: object
    RegisterQuotaRequest:
      properties:
        adjustable:
          type: boolean
        defaultValue:
          format: int32
          minimum: 0
          type: integer
        description:
          type: string
        maxValue:
          format: int32
          minimum: 0
          type: integer
        quotaCode:
          maxLength: 128
          minLength: 0
          type: string
        quotaName:
          maxLength: 256
          minLength: 0
          type: string
        serviceCode:
          maxLength: 64
          minLength: 0
          type: string
      required:
      - quotaCode
      - quotaName
      - serviceCode
      type: object
    RegisterServiceRequest:
      properties:
        actions:
          items:
            $ref: '#/components/schemas/ActionDefinition'
          minItems: 1
          type: array
        description:
          type: string
        display_name:
          minLength: 1
          type: string
        managed_permission_sets:
          items:
            $ref: '#/components/schemas/ManagedPermissionSetDefinition'
          type: array
        managed_policies:
          items:
            $ref: '#/components/schemas/ManagedPolicyDefinition'
          type: array
        managed_scps:
          items:
            $ref: '#/components/schemas/ManagedScpDefinition'
          type: array
        provisioning_defaults:
          $ref: '#/components/schemas/ProvisioningDefaults'
        service_id:
          minLength: 1
          pattern: ^[a-z][a-z0-9_-]{1,62}$
          type: string
      required:
      - actions
      - display_name
      - service_id
      type: object
    RegisterServiceResponse:
      properties:
        created:
          type: boolean
        managed_permission_sets:
          items:
            $ref: '#/components/schemas/PolicySet'
          type: array
        managed_policies:
          items:
            $ref: '#/components/schemas/IamPolicy'
          type: array
        managed_scps:
          items:
            $ref: '#/components/schemas/ServiceControlPolicy'
          type: array
        namespace:
          $ref: '#/components/schemas/ActionNamespace'
        service:
          $ref: '#/components/schemas/RegisteredService'
      type: object
    RegisteredService:
      properties:
        createdAt:
          format: date-time
          type: string
        description:
          type: string
        display_name:
          type: string
        id:
          format: uuid
          type: string
        namespace:
          $ref: '#/components/schemas/ActionNamespace'
        namespaceId:
          format: uuid
          type: string
        provisioning_defaults:
          additionalProperties: {}
          type: object
        service_id:
          type: string
        status:
          enum:
          - ACTIVE
          - INACTIVE
          type: string
        type:
          enum:
          - INTERNAL
          - EXTERNAL
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    RegistrationInitRequest:
      properties:
        email:
          format: email
          minLength: 1
          type: string
        keycloakUserId:
          minLength: 1
          type: string
      required:
      - email
      - keycloakUserId
      type: object
    RegistrationResponse:
      properties:
        id:
          format: uuid
          type: string
        reason:
          type: string
        status:
          enum:
          - PENDING
          - APPROVED
          - REFUSED
          type: string
      type: object
    RegistrationSubmitRequest:
      properties:
        accountName:
          maxLength: 63
          minLength: 3
          pattern: ^[a-z](?:[a-z0-9](?:-[a-z0-9])*)*$
          type: string
        description:
          type: string
        email:
          format: email
          minLength: 1
          type: string
        keycloakUserId:
          minLength: 1
          type: string
      required:
      - accountName
      - email
      - keycloakUserId
      type: object
    Rejected:
      properties:
        clientRef:
          type: string
        error:
          $ref: '#/components/schemas/Error'
      type: object
    RequireMfaEnrollmentRequest:
      properties:
        method:
          minLength: 1
          type: string
      required:
      - method
      type: object
    ResetRequestBody:
      properties:
        reason:
          maxLength: 512
          minLength: 0
          type: string
      type: object
    ResourcePolicy:
      properties:
        accountId:
          format: uuid
          type: string
        createdAt:
          format: date-time
          type: string
        document:
          additionalProperties: {}
          type: object
        id:
          format: uuid
          type: string
        name:
          type: string
        resourceFrn:
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    Result:
      properties:
        action:
          type: string
        decision:
          type: string
        evaluationTimeMs:
          format: int64
          type: integer
        resource:
          type: string
      type: object
    ReviewDecisionRequest:
      properties:
        decision:
          minLength: 1
          type: string
        notes:
          items:
            type: string
          type: array
      required:
      - decision
      type: object
    ReviewStatusResponse:
      properties:
        manifest_id:
          format: uuid
          type: string
        review_notes:
          items:
            type: string
          type: array
        review_status:
          type: string
        service_id:
          type: string
        state:
          enum:
          - DRAFT
          - VALIDATED
          - REGISTERED
          - PROVISIONED
          - ACTIVE
          - FAILED
          - RETIRED
          type: string
        version:
          type: string
      type: object
    RootAuditItem:
      properties:
        action:
          type: string
        payload:
          additionalProperties: {}
          type: object
        sourceIp:
          type: string
        timestamp:
          format: date-time
          type: string
        userAgent:
          type: string
      type: object
    RootAuditPage:
      properties:
        items:
          items:
            $ref: '#/components/schemas/RootAuditItem'
          type: array
        limit:
          format: int32
          type: integer
        since:
          format: date-time
          type: string
        totalCount:
          format: int32
          type: integer
      type: object
    RootCredentialMetadata:
      properties:
        daysSinceRotation:
          format: int64
          type: integer
        hardwareKeys:
          items:
            $ref: '#/components/schemas/HardwareKeyInfo'
          type: array
        passwordLastRotatedAt:
          format: date-time
          type: string
        rootEmail:
          type: string
        rootUserId:
          type: string
        rotationStatus:
          type: string
      type: object
    RotateCredentialRequest:
      properties:
        graceDays:
          format: int32
          maximum: 30
          minimum: 0
          type: integer
      required:
      - graceDays
      type: object
    RotateCredentialResponse:
      properties:
        graceExpiresAt:
          format: date-time
          type: string
        newAccessKeyId:
          type: string
        newCredentialId:
          format: uuid
          type: string
        replacedAccessKeyId:
          type: string
        replacedCredentialId:
          format: uuid
          type: string
        secretKey:
          type: string
      type: object
    Scope:
      properties:
        region:
          type: string
        service:
          type: string
      type: object
    ScopeOption:
      properties:
        access:
          type: string
        accountId:
          format: uuid
          type: string
        accountName:
          type: string
        key:
          type: string
        kind:
          type: string
        label:
          type: string
        orgId:
          format: uuid
          type: string
        orgName:
          type: string
      type: object
    ScpAttachment:
      properties:
        attachedAt:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        scpId:
          format: uuid
          type: string
        targetId:
          format: uuid
          type: string
        targetType:
          type: string
      type: object
    SelfProfile:
      properties:
        authority:
          type: string
        email:
          type: string
        firstName:
          type: string
        identityKind:
          type: string
        lastName:
          type: string
        subject:
          type: string
        username:
          type: string
      type: object
    SelfSecurity:
      properties:
        effectivePolicy:
          $ref: '#/components/schemas/EffectivePolicy'
        mfa:
          $ref: '#/components/schemas/ProfileMfaStatus'
        passwordPolicy: {}
      type: object
    SelfSession:
      properties:
        id:
          type: string
        ipAddress:
          type: string
        lastAccessAt:
          format: int64
          type: integer
        startedAt:
          format: int64
          type: integer
      type: object
    ServiceControlPolicy:
      properties:
        createdAt:
          format: date-time
          type: string
        defaultPolicy:
          type: boolean
        description:
          type: string
        document:
          additionalProperties: {}
          type: object
        id:
          format: uuid
          type: string
        managed:
          type: boolean
        name:
          type: string
        organizationId:
          format: uuid
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    ServiceQuota:
      properties:
        adjustable:
          type: boolean
        appliedValue:
          format: int32
          minimum: 0
          type: integer
        createdAt:
          format: date-time
          type: string
        defaultValue:
          format: int32
          minimum: 0
          type: integer
        description:
          type: string
        id:
          format: uuid
          type: string
        maxValue:
          format: int32
          minimum: 0
          type: integer
        organizationId:
          format: uuid
          type: string
        quotaCode:
          type: string
        quotaName:
          type: string
        serviceCode:
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    ServiceUserCredentialPolicyRequest:
      properties:
        accessKeysEnabled:
          type: boolean
        expectedVersion:
          format: int64
          minimum: 0
          type: integer
        maxAccessKeyAgeDays:
          format: int32
          maximum: 90
          minimum: 1
          type: integer
        maxActiveAccessKeys:
          format: int32
          maximum: 2
          minimum: 1
          type: integer
        maxRotationOverlapDays:
          format: int32
          maximum: 30
          minimum: 0
          type: integer
      required:
      - accessKeysEnabled
      - expectedVersion
      - maxAccessKeyAgeDays
      - maxActiveAccessKeys
      - maxRotationOverlapDays
      type: object
    ServiceUserCredentialPolicyResponse:
      properties:
        accessKeysEnabled:
          type: boolean
        accountId:
          format: uuid
          type: string
        maxAccessKeyAgeDays:
          format: int32
          type: integer
        maxActiveAccessKeys:
          format: int32
          type: integer
        maxRotationOverlapDays:
          format: int32
          type: integer
        platformMaxAccessKeyAgeDays:
          format: int32
          type: integer
        platformMaxActiveAccessKeys:
          format: int32
          type: integer
        platformMaxRotationOverlapDays:
          format: int32
          type: integer
        updatedAt:
          format: date-time
          type: string
        version:
          format: int64
          type: integer
      type: object
    SessionContextDiagnostic:
      properties:
        code:
          description: Stable diagnostic code
          type: string
        count:
          description: Number of affected assignments
          format: int64
          type: integer
        message:
          description: Safe, credential-free explanation
          type: string
      type: object
    SessionContextListResponse:
      properties:
        contexts:
          items:
            $ref: '#/components/schemas/SessionContextResponse'
          type: array
        diagnostics:
          items:
            $ref: '#/components/schemas/SessionContextDiagnostic'
          type: array
      type: object
    SessionContextOption:
      properties:
        account_id:
          description: Scoped account identifier
          format: uuid
          type: string
        account_name:
          description: Scoped account name
          type: string
        context_id:
          description: Opaque backend-issued context identifier
          type: string
        delegated_service:
          description: Delegated service name
          type: string
        label:
          description: Human-readable context label
          type: string
        metadata:
          additionalProperties:
            type: string
          type: object
        organization_id:
          description: Scoped organization identifier
          format: uuid
          type: string
        organization_name:
          description: Scoped organization name
          type: string
        permission_set_id:
          description: Identity Center permission set identifier
          format: uuid
          type: string
        permission_set_name:
          description: Identity Center permission set name
          type: string
        principal_id:
          description: Authenticated principal subject
          type: string
        realm_name:
          description: Keycloak realm that issued the token
          type: string
        type:
          description: Context type
          type: string
      type: object
    SessionContextResponse:
      properties:
        accountId:
          format: uuid
          type: string
        accountName:
          type: string
        contextId:
          type: string
        delegatedService:
          type: string
        label:
          type: string
        metadata:
          additionalProperties:
            type: string
          type: object
        organizationId:
          format: uuid
          type: string
        organizationName:
          type: string
        permissionSetId:
          format: uuid
          type: string
        permissionSetName:
          type: string
        principalId:
          type: string
        realmName:
          type: string
        type:
          type: string
      type: object
    SessionContextsResponse:
      properties:
        contexts:
          items:
            $ref: '#/components/schemas/SessionContextOption'
          type: array
        diagnostics:
          items:
            $ref: '#/components/schemas/SessionContextDiagnostic'
          type: array
      type: object
    SetDelegatedAdminRequest:
      properties:
        accountId:
          format: uuid
          type: string
        boundaryPolicyId:
          format: uuid
          type: string
        principalSub:
          maxLength: 255
          minLength: 0
          type: string
        serviceName:
          maxLength: 64
          minLength: 0
          type: string
      required:
      - accountId
      - boundaryPolicyId
      - principalSub
      - serviceName
      type: object
    SetOrgServiceDelegationRequest:
      properties:
        consentRef:
          type: string
        delegatedAdminAccountId:
          format: uuid
          type: string
      required:
      - delegatedAdminAccountId
      type: object
    SocialLinkRepresentation:
      properties:
        socialProvider:
          type: string
        socialUserId:
          type: string
        socialUsername:
          type: string
      type: object
    SortObject2:
      properties:
        empty:
          type: boolean
        sorted:
          type: boolean
        unsorted:
          type: boolean
      type: object
    SseEmitter:
      properties:
        timeout:
          format: int64
          type: integer
      type: object
    StatementDefinition:
      properties:
        Action: {}
        Effect:
          minLength: 1
          type: string
        Resource: {}
        Sid:
          type: string
      required:
      - Effect
      type: object
    TestUserSummary:
      properties:
        email:
          type: string
        user_id:
          type: string
      type: object
    TokenExchangeRequest:
      properties:
        actor_token:
          type: string
        audience:
          minLength: 1
          type: string
        grant_type:
          minLength: 1
          type: string
        requested_token_type:
          type: string
        resource:
          type: string
        scope:
          type: string
        subject_token:
          minLength: 1
          type: string
        subject_token_type:
          minLength: 1
          type: string
      required:
      - audience
      - grant_type
      - subject_token
      - subject_token_type
      type: object
    TrustPolicySummary:
      properties:
        conditions:
          additionalProperties: {}
          type: object
        createdAt:
          format: date-time
          type: string
        expiresAt:
          format: date-time
          type: string
        grantedActions:
          items:
            type: string
          type: array
        grantedBy:
          type: string
        id:
          format: uuid
          type: string
        revokedAt:
          format: date-time
          type: string
        serviceNamespace:
          type: string
        sourceAccountId:
          format: uuid
          type: string
        sourcePrincipalFrn:
          type: string
        targetAccountId:
          format: uuid
          type: string
        targetResourceFrn:
          type: string
      type: object
    UnusedAccessKeyDto:
      properties:
        accessKeyId:
          type: string
        createdAt:
          format: date-time
          type: string
        expiresAt:
          format: date-time
          type: string
        lastUsedAt:
          format: date-time
          type: string
        lastUsedSourceIp:
          type: string
        principalId:
          type: string
        principalType:
          type: string
        status:
          type: string
      type: object
    UnusedAccessKeysResponse:
      properties:
        items:
          items:
            $ref: '#/components/schemas/UnusedAccessKeyDto'
          type: array
        page:
          format: int32
          type: integer
        pageSize:
          format: int32
          type: integer
        totalCount:
          format: int32
          type: integer
      type: object
    UpdateAccountRequest:
      properties:
        description:
          type: string
        name:
          minLength: 1
          type: string
      required:
      - name
      type: object
    UpdateAccountStatusRequest:
      properties:
        status:
          minLength: 1
          type: string
      required:
      - status
      type: object
    UpdateClientRegistryRequest:
      properties:
        base_url_type:
          type: string
        description:
          type: string
        direct_access_grants:
          type: boolean
        display_name:
          type: string
        enabled:
          type: boolean
        realm_types:
          type: string
        redirect_path:
          type: string
        sort_order:
          format: int32
          type: integer
      type: object
    UpdateCredentialRequest:
      properties:
        description:
          type: string
        expiresAt:
          format: date-time
          type: string
        status:
          type: string
      required:
      - status
      type: object
    UpdateGroupRequest:
      properties:
        description:
          type: string
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
      required:
      - name
      type: object
    UpdateIamPolicyRequest:
      properties:
        description:
          type: string
        document:
          additionalProperties: {}
          type: object
      required:
      - document
      type: object
    UpdateIamUserRequest:
      properties:
        attributes:
          additionalProperties:
            type: string
          type: object
        enabled:
          type: boolean
        firstName:
          type: string
        lastName:
          type: string
      type: object
    UpdateIdcUserRequest:
      properties:
        attributes:
          additionalProperties:
            type: string
          type: object
        firstName:
          type: string
        lastName:
          type: string
      type: object
    UpdateInlinePolicyRequest:
      properties:
        document:
          additionalProperties: {}
          type: object
      required:
      - document
      type: object
    UpdateOrganizationRequest:
      properties:
        description:
          type: string
        name:
          type: string
      type: object
    UpdateOuRequest:
      properties:
        name:
          type: string
        parentId:
          format: uuid
          type: string
      type: object
    UpdatePolicySetRequest:
      properties:
        description:
          type: string
        name:
          minLength: 1
          pattern: ^[\w+=,.@-]+$
          type: string
      required:
      - name
      type: object
    UpdateResourcePolicyRequest:
      properties:
        document:
          additionalProperties: {}
          type: object
      required:
      - document
      type: object
    UpdateRoleRequest:
      properties:
        description:
          type: string
        maxSessionDuration:
          format: int32
          type: integer
        trustPolicy:
          additionalProperties: {}
          type: object
      type: object
    UpdateScpRequest:
      properties:
        description:
          type: string
        document:
          additionalProperties: {}
          type: object
      required:
      - document
      type: object
    UserConsentRepresentation:
      properties:
        clientId:
          type: string
        createdDate:
          format: int64
          type: integer
        grantedClientScopes:
          items:
            type: string
          type: array
        grantedRealmRoles:
          deprecated: true
          items:
            deprecated: true
            type: string
          type: array
        lastUpdatedDate:
          format: int64
          type: integer
      type: object
    UserPreferences:
      properties:
        locale:
          enum:
          - zh-CN
          - en-US
          - ja-JP
          type:
          - string
          - 'null'
        notification_prefs:
          $ref: '#/components/schemas/NotificationPrefs'
        theme:
          enum:
          - light
          - dark
          - system
          type:
          - string
          - 'null'
        tz:
          type:
          - string
          - 'null'
      type: object
    UserProfileAttributeGroupMetadata:
      properties:
        annotations:
          additionalProperties: {}
          type: object
        displayDescription:
          type: string
        displayHeader:
          type: string
        name:
          type: string
      type: object
    UserProfileAttributeMetadata:
      properties:
        annotations:
          additionalProperties: {}
          type: object
        defaultValue:
          type: string
        displayName:
          type: string
        group:
          type: string
        multivalued:
          type: boolean
        name:
          type: string
        readOnly:
          type: boolean
        required:
          type: boolean
        validators:
          additionalProperties:
            additionalProperties: {}
            type: object
          type: object
      type: object
    UserProfileMetadata:
      properties:
        attributes:
          items:
            $ref: '#/components/schemas/UserProfileAttributeMetadata'
          type: array
        groups:
          items:
            $ref: '#/components/schemas/UserProfileAttributeGroupMetadata'
          type: array
      type: object
    UserRepresentation:
      properties:
        access:
          additionalProperties:
            type: boolean
          type: object
        applicationRoles:
          additionalProperties:
            deprecated: true
            items:
              deprecated: true
              type: string
            type: array
          deprecated: true
          type: object
        attributes:
          additionalProperties:
            items:
              type: string
            type: array
          type: object
        clientConsents:
          items:
            $ref: '#/components/schemas/UserConsentRepresentation'
          type: array
        clientRoles:
          additionalProperties:
            items:
              type: string
            type: array
          type: object
        createdTimestamp:
          format: int64
          type: integer
        credentials:
          items:
            $ref: '#/components/schemas/CredentialRepresentation'
          type: array
        disableableCredentialTypes:
          items:
            type: string
          type: array
          uniqueItems: true
        email:
          type: string
        emailVerified:
          type: boolean
        enabled:
          type: boolean
        federatedIdentities:
          items:
            $ref: '#/components/schemas/FederatedIdentityRepresentation'
          type: array
        federationLink:
          type: string
        firstName:
          type: string
        groups:
          items:
            type: string
          type: array
        id:
          type: string
        lastName:
          type: string
        notBefore:
          format: int32
          type: integer
        origin:
          deprecated: true
          type: string
        realmRoles:
          items:
            type: string
          type: array
        requiredActions:
          items:
            type: string
          type: array
        self:
          type: string
        serviceAccountClientId:
          type: string
        socialLinks:
          deprecated: true
          items:
            $ref: '#/components/schemas/SocialLinkRepresentation'
          type: array
        totp:
          deprecated: true
          type: boolean
        userProfileMetadata:
          $ref: '#/components/schemas/UserProfileMetadata'
        username:
          type: string
      type: object
    ValidationError:
      properties:
        code:
          type: string
        field:
          type: string
        message:
          type: string
        policy_id:
          format: uuid
          type: string
      type: object
    VerificationResult:
      properties:
        brokenLinks:
          format: int64
          type: integer
        eventsChecked:
          format: int64
          type: integer
        firstMismatchEventId:
          format: uuid
          type: string
        firstMismatchTimestamp:
          format: date-time
          type: string
        lastMismatchTimestamp:
          format: date-time
          type: string
        mismatchSample:
          items:
            format: uuid
            type: string
          type: array
        ok:
          type: boolean
        rowsInWindow:
          format: int64
          type: integer
      type: object
    VerifySignatureRequest:
      properties:
        authorization:
          type: string
        bodySha256:
          type: string
        method:
          type: string
        path:
          type: string
        query:
          type: string
        sessionToken:
          type: string
        signedHeaders:
          additionalProperties:
            type: string
          type: object
        version:
          type: string
        xFgaiContentSha256:
          type: string
        xFgaiDate:
          type: string
      type: object
    VerifySignatureResponse:
      properties:
        accessKeyId:
          type: string
        detail:
          type: string
        failureCode:
          type: string
        permissionSetId:
          type: string
        principalType:
          type: string
        result:
          type: string
        scope:
          $ref: '#/components/schemas/Scope'
        sessionContextId:
          type: string
        subjectFrn:
          type: string
        version:
          type: string
      type: object
    WorkforceInviteAssignmentRequest:
      properties:
        accountId:
          format: uuid
          type: string
        permissionSetId:
          format: uuid
          type: string
      required:
      - accountId
      - permissionSetId
      type: object
    WorkforceInviteAssignmentResponse:
      properties:
        accountId:
          format: uuid
          type: string
        accountName:
          type: string
        permissionSetDescription:
          type: string
        permissionSetId:
          format: uuid
          type: string
        permissionSetName:
          type: string
      type: object
    WorkforceInviteResponse:
      properties:
        assignments:
          items:
            $ref: '#/components/schemas/WorkforceInviteAssignmentResponse'
          type: array
        email:
          type: string
        expiresAt:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        organizationId:
          format: uuid
          type: string
        organizationName:
          type: string
        reason:
          type: string
        status:
          type: string
      type: object
    AccessInfoResponse:
      properties:
        accountId:
          format: uuid
          type: string
        accountName:
          type: string
        accounts:
          items:
            $ref: '#/components/schemas/AccountSummary'
          type: array
        orgId:
          format: uuid
          type: string
        orgName:
          type: string
        scope:
          type: string
      type: object
    AccountSummary:
      properties:
        id:
          format: uuid
          type: string
        name:
          type: string
        status:
          type: string
      type: object
    AuditEvent:
      properties:
        accountId:
          format: uuid
          type: string
        actorId:
          type: string
        actorType:
          type: string
        correlationId:
          type: string
        errorCode:
          type: string
        eventCategory:
          type: string
        eventId:
          format: uuid
          type: string
        eventIdV7:
          format: uuid
          type: string
        eventName:
          type: string
        eventSource:
          type: string
        eventTime:
          format: date-time
          type: string
        request:
          additionalProperties: {}
          type: object
        resourceFrn:
          type: string
        response:
          additionalProperties: {}
          type: object
        sourceIp:
          type: string
      type: object
    CommandResult:
      properties:
        exit_code:
          format: int32
          type: integer
        output:
          type: string
      type: object
    EventDefinition:
      properties:
        category:
          type: string
        description:
          type: string
        name:
          type: string
        payloadSchema:
          $ref: '#/components/schemas/JsonNode'
        payloadSchemaRef:
          type: string
        severity:
          type: string
      type: object
    JsonNode: {}
    PageAuditEvent:
      properties:
        content:
          items:
            $ref: '#/components/schemas/AuditEvent'
          type: array
        empty:
          type: boolean
        first:
          type: boolean
        last:
          type: boolean
        number:
          format: int32
          type: integer
        numberOfElements:
          format: int32
          type: integer
        pageable:
          $ref: '#/components/schemas/PageableObject'
        size:
          format: int32
          type: integer
        sort:
          $ref: '#/components/schemas/SortObject'
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PageableObject:
      properties:
        offset:
          format: int64
          type: integer
        pageNumber:
          format: int32
          type: integer
        pageSize:
          format: int32
          type: integer
        paged:
          type: boolean
        sort:
          $ref: '#/components/schemas/SortObject'
        unpaged:
          type: boolean
      type: object
    RegistrationRequest:
      properties:
        events:
          items:
            $ref: '#/components/schemas/EventDefinition'
          type: array
        manifestVersion:
          type: string
      type: object
    RegistrationSummary:
      properties:
        created:
          format: int32
          type: integer
        events:
          format: int32
          type: integer
        reconciled:
          format: int32
          type: integer
        unchanged:
          format: int32
          type: integer
      type: object
    SortObject:
      properties:
        empty:
          type: boolean
        sorted:
          type: boolean
        unsorted:
          type: boolean
      type: object
    AppEntryResolution:
      properties:
        accountId:
          format: uuid
          type: string
        appId:
          type: string
        deepLink:
          type: string
        displayName:
          type: string
        entryKind:
          enum:
          - ONBOARDING
          - APP
          type: string
        lifecycleStatus:
          type: string
      type: object
    ApplicationResponse:
      properties:
        allowedRedirectUrls:
          items:
            type: string
          type: array
        appId:
          type: string
        createdAt:
          format: date-time
          type: string
        displayName:
          type: string
        homepageUrl:
          type: string
        ownerAccountId:
          format: uuid
          type: string
        ownerType:
          type: string
        registeredScopes:
          items:
            type: string
          type: array
        registrationRevision:
          type: string
        status:
          type: string
        updatedAt:
          format: date-time
          type: string
      type: object
    CreateLaunchLinkRequest:
      properties:
        accountId:
          format: uuid
          type: string
        appId:
          maxLength: 63
          minLength: 0
          type: string
        redirectUrl:
          maxLength: 512
          minLength: 0
          type: string
        scopes:
          items:
            type: string
          type: array
        subjectHint:
          maxLength: 255
          minLength: 0
          type: string
        ttlSeconds:
          format: int64
          type: integer
      required:
      - appId
      type: object
    CreateLaunchLinkResponse:
      properties:
        accountId:
          format: uuid
          type: string
        appId:
          type: string
        expiresAt:
          format: date-time
          type: string
        launchToken:
          type: string
        launchUrl:
          type: string
        redirectUrl:
          type: string
        scopes:
          items:
            type: string
          type: array
      type: object
    RedeemLaunchRequest:
      properties:
        launchToken:
          minLength: 1
          type: string
      required:
      - launchToken
      type: object
    RedeemLaunchResponse:
      properties:
        accountId:
          format: uuid
          type: string
        appId:
          type: string
        displayName:
          type: string
        expiresAt:
          format: date-time
          type: string
        launchTicket:
          type: string
        redirectUrl:
          type: string
        scopes:
          items:
            type: string
          type: array
      type: object
    ResolveAppEntryRequest:
      properties:
        accountId:
          format: uuid
          type: string
        appId:
          minLength: 1
          type: string
      required:
      - accountId
      - appId
      type: object
    ValidateLaunchTicketRequest:
      properties:
        appId:
          maxLength: 63
          minLength: 0
          type: string
        launchTicket:
          minLength: 1
          type: string
      required:
      - appId
      - launchTicket
      type: object
    ValidateLaunchTicketResponse:
      properties:
        accountId:
          format: uuid
          type: string
        appId:
          type: string
        displayName:
          type: string
        expiresAt:
          format: date-time
          type: string
        redirectUrl:
          type: string
        scopes:
          items:
            type: string
          type: array
        subject:
          type: string
        valid:
          type: boolean
      type: object
    AcceptMemberAccountInvitationRequest:
      properties:
        account_id:
          format: uuid
          type: string
      required:
      - account_id
      type: object
    AccountLifecycleDto:
      properties:
        account_id:
          format: uuid
          type: string
        activated_at:
          format: date-time
          type: string
        created_at:
          format: date-time
          type: string
        name:
          type: string
        org_id:
          format: uuid
          type: string
        ou_node_id:
          format: uuid
          type: string
        realm_activated_at:
          format: date-time
          type: string
        realm_status:
          type: string
        status:
          type: string
        updated_at:
          format: date-time
          type: string
        version:
          format: int64
          type: integer
      type: object
    AccountSpec:
      properties:
        account_id:
          format: uuid
          type: string
        name:
          type: string
        ou_node_id:
          format: uuid
          type: string
      type: object
    AttachMemberAccountRequest:
      properties:
        name:
          minLength: 1
          type: string
        parent_id:
          format: uuid
          type: string
      required:
      - name
      - parent_id
      type: object
    CommandResult2:
      properties:
        exit_code:
          format: int32
          type: integer
        output:
          type: string
      type: object
    CreateAccountRequest2:
      properties:
        name:
          type: string
        parent_id:
          format: uuid
          type: string
      type: object
    CreateMemberAccountInvitationRequest:
      properties:
        account_name:
          minLength: 1
          type: string
        email:
          format: email
          minLength: 1
          type: string
        target_ou_id:
          format: uuid
          type: string
      required:
      - account_name
      - email
      - target_ou_id
      type: object
    CreateOuRequest2:
      properties:
        name:
          type: string
        parent_id:
          format: uuid
          type: string
      type: object
    InternalOrgAccountDto:
      properties:
        account_id:
          format: uuid
          type: string
        name:
          type: string
        ou_node_id:
          format: uuid
          type: string
        role:
          type: string
        status:
          type: string
      type: object
    InternalOrgAccountsDto:
      properties:
        accounts:
          items:
            $ref: '#/components/schemas/InternalOrgAccountDto'
          type: array
        mgmt_account_id:
          format: uuid
          type: string
        organization_id:
          format: uuid
          type: string
      type: object
    MemberAccountInvitationDto:
      properties:
        accepted_account_id:
          format: uuid
          type: string
        accepted_at:
          format: date-time
          type: string
        accepted_by:
          type: string
        account_name:
          type: string
        created_at:
          format: date-time
          type: string
        created_by:
          type: string
        declined_at:
          format: date-time
          type: string
        declined_by:
          type: string
        email:
          type: string
        id:
          format: uuid
          type: string
        org_id:
          format: uuid
          type: string
        status:
          type: string
        target_ou_id:
          format: uuid
          type: string
        updated_at:
          format: date-time
          type: string
      type: object
    OnboardAccountsRequest:
      properties:
        accounts:
          items:
            $ref: '#/components/schemas/AccountSpec'
          type: array
        ou_node_id:
          format: uuid
          type: string
      type: object
    OnboardAccountsResponse:
      properties:
        accounts:
          items:
            $ref: '#/components/schemas/AccountLifecycleDto'
          type: array
        org_id:
          format: uuid
          type: string
        placeholders_created:
          format: int32
          type: integer
      type: object
    OuNodeDto:
      properties:
        account_id:
          format: uuid
          type: string
        children:
          items:
            $ref: '#/components/schemas/OuNodeDto'
          type: array
        id:
          format: uuid
          type: string
        name:
          type: string
        parent_id:
          format: uuid
          type: string
        path:
          type: string
        state:
          type: string
        type:
          type: string
        version:
          format: int64
          type: integer
      type: object
    OuNodeWriteDto:
      properties:
        account_id:
          format: uuid
          type: string
        created_at:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        name:
          type: string
        parent_id:
          format: uuid
          type: string
        path:
          type: string
        state:
          type: string
        type:
          type: string
        updated_at:
          format: date-time
          type: string
        version:
          format: int64
          type: integer
      type: object
    ReparentOuRequest:
      properties:
        new_parent_id:
          format: uuid
          type: string
      type: object
    AccountQuotaDefaultDto:
      properties:
        adjustable:
          type: boolean
        appliedValue:
          format: int64
          type: integer
        createdAt:
          format: date-time
          type: string
        defaultValue:
          format: int64
          type: integer
        description:
          type: string
        id:
          type: string
        maxValue:
          format: int64
          type: integer
        name:
          type: string
        quotaCode:
          type: string
        quotaName:
          type: string
        serviceCode:
          type: string
        unit:
          type: string
      type: object
    AccountQuotaDto:
      properties:
        account:
          type: string
        adjustable:
          type: boolean
        current:
          format: int64
          type: integer
        defaultValue:
          format: int64
          type: integer
        description:
          type: string
        id:
          type: string
        limit:
          format: int64
          type: integer
        name:
          type: string
        quotaCode:
          type: string
        quotaId:
          type: string
        raisable:
          type: boolean
        regional:
          type: boolean
        service:
          type: string
        serviceCode:
          type: string
        state:
          type: string
        unit:
          type: string
      type: object
    AppliedQuotaView:
      properties:
        accountId:
          format: uuid
          type: string
        adjustable:
          type: boolean
        appliedValue:
          format: int64
          type: integer
        contextKey:
          type: string
        defaultValue:
          format: int64
          type: integer
        definitionVersion:
          format: int64
          type: integer
        maximumValue:
          format: int64
          type: integer
        minimumValue:
          format: int64
          type: integer
        periodSeconds:
          format: int64
          type: integer
        projectionVersion:
          format: int64
          type: integer
        quotaCode:
          type: string
        reconciliationTtlSeconds:
          format: int64
          type: integer
        servedAt:
          format: date-time
          type: string
        serviceCode:
          type: string
        source:
          type: string
        unit:
          type: string
        updatedAt:
          format: date-time
          type: string
        usage:
          $ref: '#/components/schemas/UsageView'
        usageMetric:
          type: string
      type: object
    Definition:
      properties:
        adjustable:
          type: boolean
        defaultValue:
          format: int64
          type: integer
        description:
          type: string
        displayName:
          type: string
        global:
          type: boolean
        key:
          type: string
        maximumValue:
          format: int64
          type: integer
        minimumValue:
          format: int64
          type: integer
        periodSeconds:
          format: int64
          type: integer
        scope:
          type: string
        unit:
          type: string
        usageMetric:
          type: string
      type: object
    PageEnvelopeQuotaRequestDto:
      properties:
        items:
          items:
            $ref: '#/components/schemas/QuotaRequestDto'
          type: array
        total:
          format: int64
          type: integer
      type: object
    Pageable:
      properties:
        page:
          format: int32
          minimum: 0
          type: integer
        size:
          format: int32
          minimum: 1
          type: integer
        sort:
          items:
            type: string
          type: array
      type: object
    QuotaRequestDto:
      properties:
        accountId:
          format: uuid
          type: string
        approvedValue:
          format: int64
          type: integer
        contextKey:
          type: string
        currentValue:
          format: int64
          type: integer
        id:
          format: uuid
          type: string
        justification:
          type: string
        requestedAt:
          format: date-time
          type: string
        requestedValue:
          format: int64
          type: integer
        reviewedAt:
          format: date-time
          type: string
        reviewerId:
          format: uuid
          type: string
        reviewerNotes:
          type: string
        serviceCode:
          type: string
        status:
          type: string
        templateKey:
          type: string
      type: object
    QuotaScopesResponse2:
      properties:
        scope:
          type: string
        scopes:
          items:
            $ref: '#/components/schemas/ScopeOption2'
          type: array
      type: object
    QuotaThresholdDto:
      properties:
        accountId:
          type: string
        dangerPct:
          format: int32
          type: integer
        enabled:
          type: boolean
        quotaCode:
          type: string
        quotaId:
          type: string
        serviceCode:
          type: string
        warnPct:
          format: int32
          type: integer
      type: object
    RegistrationRequest2:
      properties:
        definitions:
          items:
            $ref: '#/components/schemas/Definition'
          type: array
        manifestVersion:
          type: string
      type: object
    RegistrationSummary2:
      properties:
        created:
          format: int32
          type: integer
        definitions:
          format: int32
          type: integer
        reconciled:
          format: int32
          type: integer
        unchanged:
          format: int32
          type: integer
      type: object
    ScopeOption2:
      properties:
        access:
          type: string
        accountId:
          type: string
        accountName:
          type: string
        eligible:
          type: boolean
        helper:
          type: string
        key:
          type: string
        kind:
          type: string
        label:
          type: string
        orgId:
          type: string
        orgName:
          type: string
        reason:
          type: string
        role:
          type: string
      type: object
    SubmitQuotaRequest:
      properties:
        contextKey:
          type: string
        justification:
          type: string
        quotaId:
          type: string
        requestedValue:
          format: int64
          type: integer
        serviceCode:
          type: string
      type: object
    ThresholdEnvelope:
      properties:
        items:
          items:
            $ref: '#/components/schemas/QuotaThresholdDto'
          type: array
      type: object
    UsageReport:
      properties:
        accountId:
          format: uuid
          type: string
        contextKey:
          type: string
        observedAt:
          format: date-time
          type: string
        usageValue:
          format: int64
          type: integer
      required:
      - accountId
      - observedAt
      type: object
    UsageView:
      properties:
        freshness:
          type: string
        observedAt:
          format: date-time
          type: string
        receivedAt:
          format: date-time
          type: string
        value:
          format: int64
          type: integer
      type: object
    AuthenticationPolicyDto:
      properties:
        allowedMethods:
          items:
            type: string
          type: array
        gracePeriodDays:
          format: int32
          type: integer
        organizationId:
          format: uuid
          type: string
        promptMode:
          type: string
        source:
          type: string
        unenrolledBehavior:
          type: string
        updatedAt:
          format: date-time
          type: string
        updatedBy:
          type: string
        version:
          format: int64
          type: integer
      type: object
    AuthenticationPolicyWriteRequest:
      properties:
        allowedMethods:
          items:
            type: string
          type: array
        gracePeriodDays:
          format: int32
          type: integer
        promptMode:
          type: string
        unenrolledBehavior:
          type: string
        version:
          format: int64
          type: integer
      type: object
    CreateAssignmentRequest:
      properties:
        accountIds:
          items:
            format: uuid
            type: string
          maxItems: 50
          minItems: 1
          type: array
        permissionSetId:
          format: uuid
          type: string
        principalId:
          format: uuid
          type: string
        principalType:
          minLength: 1
          pattern: user|group
          type: string
      required:
      - accountIds
      - permissionSetId
      - principalId
      - principalType
      type: object
    EffectiveAccessDto:
      properties:
        accountId:
          format: uuid
          type: string
        accountName:
          type: string
        roleName:
          type: string
        source:
          type: string
        sourceName:
          type: string
      type: object
    GroupRef:
      properties:
        id:
          format: uuid
          type: string
        name:
          type: string
      type: object
    IamGroupDto:
      properties:
        id:
          format: uuid
          type: string
        lastSyncAt:
          format: date-time
          type: string
        memberCount:
          format: int32
          type: integer
        name:
          type: string
        source:
          type: string
        sourceProviderName:
          type: string
      type: object
    IamUserDto2:
      properties:
        email:
          type: string
        groups:
          items:
            $ref: '#/components/schemas/GroupRef'
          type: array
        id:
          format: uuid
          type: string
        lastSignInAt:
          format: date-time
          type: string
        lastSyncAt:
          format: date-time
          type: string
        source:
          type: string
        sourceProviderName:
          type: string
        status:
          type: string
        username:
          type: string
      type: object
    IdentitySourceDto:
      properties:
        attributeMapping:
          additionalProperties:
            type: string
          type: object
        certFingerprint:
          type: string
        clientSecret:
          type: string
          writeOnly: true
        connectedAt:
          format: date-time
          type: string
        disconnectedAt:
          format: date-time
          type: string
        idpAlias:
          type: string
        lastSyncAt:
          format: date-time
          type: string
        lastSyncGroupsCount:
          format: int32
          type: integer
        lastSyncUsersCount:
          format: int32
          type: integer
        protocol:
          type: string
        providerLogoUrl:
          type: string
        scimEnabled:
          type: boolean
        scimSyncIntervalSeconds:
          format: int32
          type: integer
        ssoUrl:
          type: string
      type: object
    InternalAssignmentReconcileRequest:
      properties:
        accountId:
          format: uuid
          type: string
        operation:
          enum:
          - ASSIGN
          - UNASSIGN
          type: string
        permissionSetId:
          format: uuid
          type: string
        permissionSetName:
          maxLength: 255
          minLength: 1
          type: string
        permissionSetReferencePresent:
          type: boolean
        principalId:
          format: uuid
          type: string
        principalType:
          pattern: user|group
          type: string
      required:
      - accountId
      - operation
      - principalId
      - principalType
      type: object
    InternalAssignmentReconcileResponse:
      properties:
        assignmentId:
          format: uuid
          type: string
        changed:
          type: boolean
        state:
          type: string
      type: object
    JsonNode2:
      properties:
        array:
          type: boolean
        bigDecimal:
          type: boolean
        bigInteger:
          type: boolean
        binary:
          type: boolean
        boolean:
          type: boolean
        container:
          type: boolean
        double:
          type: boolean
        embeddedValue:
          type: boolean
        empty:
          type: boolean
        float:
          type: boolean
        floatingPointNumber:
          type: boolean
        int:
          type: boolean
        integralNumber:
          type: boolean
        long:
          type: boolean
        missingNode:
          type: boolean
        nodeType:
          enum:
          - ARRAY
          - BINARY
          - BOOLEAN
          - MISSING
          - 'NULL'
          - NUMBER
          - OBJECT
          - POJO
          - STRING
          type: string
        'null':
          type: boolean
        number:
          type: boolean
        object:
          type: boolean
        pojo:
          type: boolean
        short:
          type: boolean
        string:
          type: boolean
        textual:
          deprecated: true
          type: boolean
        valueNode:
          type: boolean
      type: object
    KeyValue:
      properties:
        key:
          maxLength: 128
          minLength: 1
          pattern: ^[\p{L}\p{Z}\p{N}_.:/=+\-@]*$
          type: string
        value:
          maxLength: 256
          minLength: 0
          pattern: ^[\p{L}\p{Z}\p{N}_.:/=+\-@]*$
          type: string
      required:
      - key
      - value
      type: object
    PagedResponseIamGroupDto:
      properties:
        items:
          items:
            $ref: '#/components/schemas/IamGroupDto'
          type: array
        page:
          format: int32
          type: integer
        size:
          format: int32
          type: integer
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PagedResponseIamUserDto:
      properties:
        items:
          items:
            $ref: '#/components/schemas/IamUserDto2'
          type: array
        page:
          format: int32
          type: integer
        size:
          format: int32
          type: integer
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PagedResponsePermissionSetSummaryDto:
      properties:
        items:
          items:
            $ref: '#/components/schemas/PermissionSetSummaryDto'
          type: array
        page:
          format: int32
          type: integer
        size:
          format: int32
          type: integer
        totalElements:
          format: int64
          type: integer
        totalPages:
          format: int32
          type: integer
      type: object
    PermissionSetDetailDto:
      properties:
        accountsCount:
          format: int64
          type: integer
        assignmentCount:
          format: int64
          type: integer
        attachability:
          type: string
        attachedPolicyCount:
          format: int64
          type: integer
        audience:
          type: string
        category:
          type: string
        createdAt:
          format: date-time
          type: string
        declaringOwner:
          type: string
        definition:
          $ref: '#/components/schemas/JsonNode2'
        description:
          type: string
        highRisk:
          type: boolean
        id:
          format: uuid
          type: string
        name:
          type: string
        organizationId:
          format: uuid
          type: string
        principalsCount:
          format: int64
          type: integer
        provenance:
          type: string
        relayState:
          type: string
        risk:
          type: string
        scope:
          type: string
        sessionAccess:
          type: string
        sessionBearing:
          type: boolean
        sessionDuration:
          type: string
        slug:
          type: string
        state:
          type: string
        tags:
          items:
            $ref: '#/components/schemas/KeyValue'
          type: array
        type:
          type: string
        updatedAt:
          format: date-time
          type: string
        version:
          format: int64
          type: integer
      type: object
    PermissionSetProvisionDto:
      properties:
        accountId:
          format: uuid
          type: string
        appliedAt:
          format: date-time
          type: string
        appliedVersion:
          format: int64
          type: integer
        attempts:
          format: int32
          type: integer
        desiredVersion:
          format: int64
          type: integer
        lastError:
          type: string
        permissionSetId:
          format: uuid
          type: string
        requestedAt:
          format: date-time
          type: string
        status:
          type: string
      type: object
    PermissionSetSummaryDto:
      properties:
        accountsCount:
          format: int64
          type: integer
        assignmentCount:
          format: int64
          type: integer
        attachability:
          type: string
        attachedPolicyCount:
          format: int64
          type: integer
        audience:
          type: string
        category:
          type: string
        createdAt:
          format: date-time
          type: string
        declaringOwner:
          type: string
        description:
          type: string
        highRisk:
          type: boolean
        id:
          format: uuid
          type: string
        name:
          type: string
        organizationId:
          format: uuid
          type: string
        principalsCount:
          format: int64
          type: integer
        provenance:
          type: string
        relayState:
          type: string
        risk:
          type: string
        scope:
          type: string
        sessionAccess:
          type: string
        sessionBearing:
          type: boolean
        sessionDuration:
          type: string
        slug:
          type: string
        state:
          type: string
        type:
          type: string
        updatedAt:
          format: date-time
          type: string
        version:
          format: int64
          type: integer
      type: object
    PermissionSetWriteRequest:
      properties:
        definition:
          $ref: '#/components/schemas/JsonNode2'
        description:
          maxLength: 700
          minLength: 0
          type: string
        name:
          maxLength: 32
          minLength: 0
          pattern: ^[A-Za-z0-9_+=,.@-]+$
          type: string
        relayState:
          maxLength: 240
          minLength: 0
          type: string
        sessionDuration:
          pattern: ^PT(?:[1-9]|1[0-2])H$
          type: string
        tags:
          items:
            $ref: '#/components/schemas/KeyValue'
          maxItems: 75
          minItems: 0
          type: array
      required:
      - definition
      - name
      type: object
    ScimSyncLogDto:
      properties:
        errorMessage:
          type: string
        finishedAt:
          format: date-time
          type: string
        groupsAdded:
          format: int32
          type: integer
        groupsRemoved:
          format: int32
          type: integer
        groupsUpdated:
          format: int32
          type: integer
        jobId:
          format: uuid
          type: string
        startedAt:
          format: date-time
          type: string
        status:
          type: string
        usersAdded:
          format: int32
          type: integer
        usersRemoved:
          format: int32
          type: integer
        usersUpdated:
          format: int32
          type: integer
      type: object
  securitySchemes:
    FgaiHmacSha256:
      type: apiKey
      in: header
      name: Authorization
      description: 'FGAI-HMAC-SHA256 request signature. Sign the canonical request with a FlexGalaxy access key — a static
        service-user key (`AKIA…`) or a temporary workforce-STS key (`ASIA…`, which must also send `X-Fgai-Security-Token`)
        — and send it as `Authorization: FGAI-HMAC-SHA256 Credential=<access-key-id>/<scope>, SignedHeaders=<list>, Signature=<hex>`.
        Keycloak bearer tokens are a browser session mechanism and are NOT the programmatic contract.'
servers:
- url: https://api.flexgalaxy.ai
  description: FlexGalaxy API gateway
security:
- FgaiHmacSha256: []
