components: schemas: github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.BreakdownEntry: properties: used_usd: type: string value: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.BreakdownResponse: properties: by_model: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.BreakdownEntry type: array uniqueItems: false by_provider: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.BreakdownEntry type: array uniqueItems: false by_user: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.BreakdownEntry type: array uniqueItems: false period: type: string period_end: type: string period_start: type: string scope: type: string subject_id: type: string total_used_usd: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.BudgetSpec: properties: limit_usd: description: >- LimitUSD is the per-period cap as a decimal string (e.g. "10.000000000"). type: string period: description: 'Period is the calendar bucket: "day", "month", or "year".' type: string scope: description: 'Scope is the principal tier: "user" or "group".' type: string subject_id: description: >- SubjectID is the opaque principal identifier: the OIDC subject for a user budget, the directory group UUID for a group budget. type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.CellItem: properties: limit_usd: type: string on_default: description: >- OnDefault is true when this cell's limit was coalesced from the org-wide default user budget (a defaulted spender with no explicit budget row) rather than read from an explicit row. Server-provided so a client can distinguish an exception (explicit budget) from a cell on the default. type: boolean ordinal: description: Ordinal is the group charge-precedence position (0 for user cells). type: integer period: type: string period_end: type: string period_start: type: string remaining_usd: description: RemainingUSD is LimitUSD minus UsedUSD clamped at zero. type: string scope: type: string subject_id: type: string used_usd: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ChargeRecord: properties: auth_subject: type: string charged_usd: description: ChargedUSD is a decimal string with 9 fractional digits. type: string event_id: description: Flattened context from the 1:1-joined usage event. type: string event_time: type: string id: type: string interaction_id: type: string model: type: string period_end: type: string period_start: type: string pricing_catalog_id: type: string provider: type: string scope: description: Scope and SubjectID identify the payer the charge was attributed to. type: string subject_id: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.DimensionSliceResponse: properties: dimension: type: string entries: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.BreakdownEntry type: array uniqueItems: false period: type: string period_end: type: string period_start: type: string scope: type: string subject_id: type: string total_used_usd: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse: properties: error: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.EventRecord: properties: auth_issuer: type: string auth_subject: description: |- Claimed identity. AuthSubject is always present; AuthIssuer is empty until the gateway populates subject.claims on the webhook envelope. type: string duration_ms: type: integer event_time: type: string id: type: string ingest_time: type: string interaction_id: type: string model: type: string outcome: type: string platform_groups: items: type: string type: array uniqueItems: false platform_user_id: description: Typed identity; empty until the directory service is wired. type: string provider: description: Interaction context. type: string raw_usage: description: >- RawUsage is the provider's usage block verbatim; null when the response carried none. Token telemetry lives only here — the API does not parse or normalize it. type: object requested_model: type: string route: type: string upstream_status: type: integer virtual_key_id: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.GetBudgetsResponse: properties: budgets: description: >- Budgets is the current budget collection in the same shape PUT accepts. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.BudgetSpec type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.GetDefaultUserBudgetResponse: properties: limit_usd: description: >- LimitUSD is the per-period cap as a decimal string (e.g. "10.000000000"). type: string period: description: 'Period is the calendar bucket: "day", "month", or "year".' type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.GetPricingEntryResponse: properties: anthropic: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingAnthropicRates google: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingGoogleRates model: type: string openai: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingOpenAIRates provider: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.GetPricingResponse: properties: effective_from: description: EffectiveFrom is the timestamp at which this version became active. type: string provider_aliases: additionalProperties: type: string description: >- ProviderAliases folds a data-plane provider spelling onto the provider a PricingCatalogEntry is keyed under, for the spellings where the two differ. A client joining a model list against Spec.Entries MUST apply it to BOTH sides — the model's provider AND the entry's own Provider — after lowercasing and trimming each, falling back to that normalized spelling when it is absent from the map. Both halves are load-bearing. Spec is returned verbatim as stored, so an entry carries the spelling whoever authored it typed, while the server keyed its own row on the folded spelling; folding only the model's side leaves an entry authored as "vertex" unreachable from a data plane reporting "vertex". And the server's fold lowercases and trims first, so a client matching raw prices nothing for a spelling the charge path bills without complaint. It exists because the two names come from different vocabularies and are not reconcilable by the client: a data plane reports the provider it was configured with (sprout's provider kind, or the legacy gateway's provider CR Name) while an entry is keyed on the rate sheet it bills off. Two distinct providers can share one sheet — AI Studio and Vertex both price as "google" — so the fold is deliberately many-to-one and cannot be undone by renaming either side. Only non-identity folds are present, so an absent key means "already the catalog spelling", not "unknown provider". Omitted when empty. type: object spec: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingCatalogSpec type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ListChargesResponse: properties: charges: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ChargeRecord type: array uniqueItems: false next_cursor: description: NextCursor is passed back verbatim as the cursor query parameter. type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ListEventsResponse: properties: events: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.EventRecord type: array uniqueItems: false next_cursor: description: NextCursor is passed back verbatim as the cursor query parameter. type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.MeCellItem: properties: limit_usd: type: string my_contribution_usd: type: string on_default: description: >- OnDefault is true when this cell's limit was coalesced from the org-wide default user budget (a defaulted spender with no explicit budget row) rather than read from an explicit row. Server-provided so a client can distinguish an exception (explicit budget) from a cell on the default. type: boolean ordinal: description: Ordinal is the group charge-precedence position (0 for user cells). type: integer period: type: string period_end: type: string period_start: type: string remaining_usd: description: RemainingUSD is LimitUSD minus UsedUSD clamped at zero. type: string scope: type: string subject_id: type: string used_usd: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.MeSummaryResponse: properties: budgets: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.MeCellItem type: array uniqueItems: false day: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PersonalCard month: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PersonalCard subject: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PersonalCard: properties: budgets: description: >- Budgets counts the budgets contributing to the card (one per period grain today), so a UI can badge multi-budget rollups. type: integer limit_usd: type: string period_end: type: string period_start: type: string remaining_usd: type: string used_usd: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingAnthropicRates: properties: cacheCreation1hInputUsdPerMillion: type: string cacheCreation5mInputUsdPerMillion: type: string cachedInputUsdPerMillion: type: string inputUsdPerMillion: type: string outputUsdPerMillion: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingAnthropicToolRates: properties: webSearchUsdPerThousand: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingCatalogEntry: properties: anthropic: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingAnthropicRates google: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingGoogleRates model: type: string openai: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingOpenAIRates provider: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingCatalogSpec: description: Spec is the typed rate table stored for this version. properties: entries: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingCatalogEntry type: array uniqueItems: false tools: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingToolRates type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingGoogleRates: properties: audioInputUsdPerMillion: type: string audioOutputUsdPerMillion: type: string cachedAudioInputUsdPerMillion: type: string cachedInputUsdPerMillion: type: string inputUsdPerMillion: type: string outputUsdPerMillion: type: string promptSizeTiers: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingPromptSizeTier type: array uniqueItems: false thoughtsOutputUsdPerMillion: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingGoogleToolRates: properties: groundingSearchUsdPerThousand: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingOpenAIRates: properties: audioInputUsdPerMillion: type: string audioOutputUsdPerMillion: type: string cachedInputUsdPerMillion: type: string inputUsdPerMillion: type: string outputUsdPerMillion: type: string promptSizeTiers: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingPromptSizeTier type: array uniqueItems: false reasoningOutputUsdPerMillion: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingOpenAIToolRates: properties: fileSearchUsdPerThousand: type: string webSearchUsdPerThousand: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingPromptSizeTier: properties: aboveTokens: type: integer cachedInputUsdPerMillion: type: string inputUsdPerMillion: type: string outputUsdPerMillion: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingToolRates: properties: anthropic: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingAnthropicToolRates google: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingGoogleToolRates openai: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingOpenAIToolRates type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PutDefaultUserBudgetRequest: properties: limit_usd: description: >- LimitUSD is the per-period cap as a decimal string (e.g. "10.000000000"). type: string period: description: 'Period is the calendar bucket: "day", "month", or "year".' type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PutGroupBudgetRequest: properties: limit_usd: description: >- LimitUSD is the per-period cap as a decimal string (e.g. "10.000000000"). type: string period: description: 'Period is the calendar bucket: "day", "month", or "year".' type: string precedence: description: >- Precedence is the group's 1-based charge order; lower is charged first and the minimum is 1 (0 is reserved for users). Maps to the domain Budget's ordinal after server-side re-sequencing. type: integer type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PutPricingEntryRequest: properties: anthropic: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingAnthropicRates google: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingGoogleRates openai: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PricingOpenAIRates type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PutUserBudgetRequest: properties: limit_usd: description: >- LimitUSD is the per-period cap as a decimal string (e.g. "10.000000000"). type: string period: description: 'Period is the calendar bucket: "day", "month", or "year".' type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.SetBudgetsRequest: properties: budgets: description: Budgets is the full desired budget collection. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.BudgetSpec type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.SpendBucket: properties: date: type: string usd: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.SpendSeriesResponse: properties: buckets: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.SpendBucket type: array uniqueItems: false from: type: string granularity: type: string to: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.SummaryResponse: properties: cells: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.CellItem type: array uniqueItems: false next_cursor: description: NextCursor pages forward; absent on the last page. type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AWSStsAuthDTO: properties: fallback_role_arn: type: string provider_id: type: string region: type: string role_claim: type: string role_mappings: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.RoleMappingDTO type: array uniqueItems: false service: type: string session_duration: type: integer session_name_claim: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AWSStsAuthRequest: properties: fallback_role_arn: type: string provider_id: type: string region: type: string role_claim: type: string role_mappings: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.RoleMappingRequest type: array uniqueItems: false service: type: string session_duration: type: integer session_name_claim: type: string required: - provider_id - region type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse: properties: error: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.BearerTokenAuthRequest: properties: token: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ClientSecretRefDTO type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ClientSecretRefDTO: properties: kubernetes_secret: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.KubernetesSecretRefDTO managed_secret_id: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectionDTO: properties: connector_id: type: string created_at: type: string enabled: type: boolean gateway_id: type: string id: type: string tools_enabled_by_default: type: boolean tools_exception_list: items: type: string type: array uniqueItems: false updated_at: type: string user_id: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorAuthDTO: properties: aws_sts: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AWSStsAuthDTO header_injection: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.HeaderInjectionAuthDTO obo: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.OBOAuthDTO token_exchange: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.TokenExchangeAuthDTO type: enum: - none - bearerToken - headerInjection - upstreamInject - tokenExchange - awsSts - obo - xaa type: string upstream_inject: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.UpstreamInjectAuthDTO xaa: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.XAAAuthDTO type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorAuthRequest: properties: aws_sts: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AWSStsAuthRequest bearer_token: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.BearerTokenAuthRequest header_injection: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.HeaderInjectionAuthRequest obo: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.OBOAuthRequest token_exchange: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.TokenExchangeAuthRequest type: enum: - none - bearerToken - headerInjection - upstreamInject - tokenExchange - awsSts - obo - xaa type: string upstream_inject: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.UpstreamInjectAuthRequest xaa: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.XAAAuthRequest required: - type type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorDTO: properties: allow_private_ips: type: boolean auth: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorAuthDTO created_at: type: string deployment_mode: description: >- DeploymentMode is how this Connector's MCP server is run: kubernetes or proxy_remote. Not independently settable — it reads through to Origin (only kubernetes_cluster yields kubernetes), so there is no corresponding field on ConnectorWriteRequest to ignore or reject. type: string description: type: string endpoint: type: string gateway_id: type: string icon_url: description: |- IconURL is the connector's optional icon/logo link, or absent when unset. type: string id: type: string name: type: string origin: description: >- Origin is where this Connector came from: manual, kubernetes_cluster, custom_registry or stacklok_registry. Always rendered; a Connector created before provenance existed reads as manual. Set at creation and never changed — a PUT carrying it is accepted and the value ignored. type: string repository_url: description: |- RepositoryURL is the connector's optional source-code link, or absent when unset. type: string source_name: description: >- SourceName is the name of the object this Connector was created from. Present only for kubernetes_cluster. type: string source_namespace: description: >- SourceNamespace is the namespace of the object this Connector was created from. Present only for kubernetes_cluster. type: string status: description: Status is one of the ConnectorStatus* values below. type: string support_url: description: |- SupportURL is the connector's optional support/homepage link, or absent when unset. type: string transport: type: string updated_at: type: string version: description: |- Version is the connector's optional, free-text version string, or absent when unset. type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorIdentityProviderDTO: properties: created_at: type: string id: type: string name: type: string oauth2_config: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.OAuth2ConfigDTO oidc_config: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.OIDCConfigDTO provider_type: type: string registration_mode: type: string source: type: string updated_at: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorPolicyDTO: properties: connector_id: type: string document: type: string granted_user_groups: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorPolicyGroupRefDTO type: array uniqueItems: false mode: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorPolicyGroupRefDTO: properties: id: type: string name: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorWriteRequest: properties: allow_private_ips: type: boolean auth: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorAuthRequest description: type: string draft: description: >- Draft withholds this Connector from its gateway while an Admin is still configuring it. Required on create and on update alike: publishing is {"draft": false} and withdrawing is {"draft": true} on this same full-replace route — there is no separate publish endpoint. type: boolean endpoint: type: string icon_url: description: |- IconURL is the connector's optional icon/logo link. When set, must be an absolute http or https URL. type: string name: type: string origin: description: >- Origin records where this Connector came from. Omit it entirely for a hand-entered Connector (it defaults to "manual"); an explicitly empty string is rejected with 400. Legal values: manual, kubernetes_cluster, custom_registry, stacklok_registry. Ignored on update — provenance is a fact about creation, so PUT neither changes nor clears it. type: string repository_url: description: |- RepositoryURL is the connector's optional source-code link. When set, must be an absolute http or https URL. type: string source_name: description: >- SourceName is the name of the object this Connector was created from. Required together with source_namespace when origin is kubernetes_cluster, and must be empty when origin is manual. Ignored on update. type: string source_namespace: description: >- SourceNamespace is the namespace of the object this Connector was created from. Required together with source_name when origin is kubernetes_cluster, and must be empty when origin is manual. Ignored on update. type: string support_url: description: |- SupportURL is the connector's optional support/homepage link. When set, must be an absolute http or https URL. type: string transport: type: string version: description: Version is the connector's optional, free-text version string. type: string required: - draft - endpoint - name - transport type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateConnectionRequest: properties: connector_id: type: string enabled: type: boolean gateway_id: type: string tools_enabled_by_default: type: boolean tools_exception_list: items: type: string type: array uniqueItems: false required: - connector_id - gateway_id type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateConnectorIdentityProviderRequest: properties: name: type: string oauth2_config: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.OAuth2ConfigDTO oidc_config: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.OIDCConfigDTO provider_type: type: string required: - name - provider_type type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateGroupRequest: properties: description: type: string display_name: type: string required: - display_name type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateKeyRequest: properties: metadata: additionalProperties: type: string type: object name: description: >- Name is an optional, user-supplied label for the key (e.g. "my-ide-key"), at most 255 characters. It is stored alongside the key and surfaced back on every read; callers that omit it see an empty name. A name may also be supplied as metadata["name"]; the top-level field takes precedence and the same length limit applies either way. Persisted in the key's metadata rather than a dedicated column, but exposed as a first-class field so it is discoverable in the schema and validated by shape. maxLength: 255 type: string ttl_seconds: description: >- TTLSeconds is the key's lifetime in seconds. Zero (or absent) means no expiration. minimum: 0 type: integer type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateKeyResponse: properties: key: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.KeyDTO secret: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateManagedSecretRequest: properties: name: type: string value: type: string required: - name - value type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.DCRConfigDTO: properties: discovery_url: type: string initial_access_token: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ClientSecretRefDTO registration_endpoint: type: string software_id: type: string software_statement: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.DiscoveredServerDTO: properties: allow_private_ips: description: >- AllowPrivateIPs is the value a create body should carry for this candidate: a RECOMMENDATION, never an enforcement. True only when the scan verified the endpoint is the in-cluster Service form for this server's own namespace. Always rendered, including as false, so "not offered" stays distinguishable from "no opinion". It does not constrain writes: the field is caller-supplied on ConnectorWriteRequest, so an Admin can post it for any endpoint exactly as they could by hand. What this constrains is only what the scan OFFERS. The verification rule and the reasoning behind it live in models.DiscoveredServer.HasInClusterServiceEndpoint. They are deliberately NOT restated here: swaggo copies this comment verbatim into all three swagger.json copies and types.gen.ts, and httpserver/docs.go serves the spec unauthenticated — so anything written here is published to anonymous callers. type: boolean endpoint: description: >- Endpoint is the server's in-cluster URL in its canonical normalized form — the value a create body must carry verbatim. type: string existing_connectors: description: >- ExistingConnectors are the Connectors on the scanned Gateway that already hold this endpoint. Empty means "not yet admitted here". A list rather than an already_added boolean: it names which Connector an Admin would be editing instead of creating, and it needs no reshaping if a Connector ever gains parameters and two Connectors on one endpoint become legitimate. Always an array, never null — see DiscoveredServerListResponse. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ExistingConnectorDTO type: array uniqueItems: false group: description: >- Group is the MCPGroup the server belongs to, or "" when it is ungrouped. No omitempty: ungrouped is a normal state, not an absent field, and a key that appears only sometimes makes every client distinguish two cases that mean the same thing. type: string health: description: >- Health is the server's phase as the Operator reports it, or "Unknown" when the Operator has published none yet. It is NOT a readiness signal, and no field here is. Whether a server is running is an Operator fact; whether this Org has finished wiring it is org-local and is answered by ExistingConnectors below. Presenting the former as readiness would send an Admin to fix configuration that was never wrong. type: string name: description: Name is the MCPServer object's name. type: string namespace: description: >- Namespace is the MCPServer object's namespace. Carried alongside Name because the pair is the provenance reference an admission records, and because a cluster-wide scan can legitimately return two servers of the same name in different namespaces. type: string transport: description: >- Transport is the protocol a client actually speaks to the server's proxy. type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.DiscoveredServerListResponse: properties: servers: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.DiscoveredServerDTO type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ExistingConnectorDTO: properties: id: type: string name: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GrantConnectorPolicyUserGroupsRequest: properties: group_ids: description: >- `required` WITHOUT `dive,uuid`, deliberately. The tag runs in decodeAndValidate before parsePolicyGroupIDs, so `dive,uuid` would be the effective gate — and validator's `uuid` accepts only the canonical dashed lowercase form while uuid.Parse, which every other id on these routes goes through (including this resource's own DELETE path param), also takes the dashless, URN, and brace-wrapped spellings. Keeping it here would silently narrow what the set-write accepts relative to its sibling, which is the URL-param-through- struct-tags divergence .claude/rules/http-dto-validation.md warns about, arriving from the other direction. `required` stays, and carries real weight: on a slice it is !IsNil(), so an omitted or null field is a 400 while `[]` passes through as the deliberate revoke-all. That distinction is the difference between a malformed request and total revocation, so it is pinned by tests at the REST layer rather than left resting on the library's behaviour. items: type: string type: array uniqueItems: false required: - group_ids type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO: properties: created_at: type: string description: type: string display_name: type: string id: type: string members: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupMemberDTO type: array uniqueItems: false name: type: string source: type: string transitive_member_count: type: integer updated_at: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupMemberDTO: properties: display: type: string id: type: string type: description: '"User" | "Group"' type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.HeaderInjectionAuthDTO: properties: header_name: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.HeaderInjectionAuthRequest: properties: header_name: type: string value: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ClientSecretRefDTO required: - header_name type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.KeyDTO: properties: created_at: type: string created_by: type: string expires_at: type: string id: type: string last_used_at: type: string metadata: additionalProperties: type: string type: object name: type: string owner_ref: type: string prefix: type: string status: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.KubernetesSecretRefDTO: properties: key: type: string name: type: string namespace: type: string required: - key - name - namespace type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ListKeysResponse: properties: keys: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.KeyDTO type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ManagedSecretDTO: properties: created_at: type: string id: type: string name: type: string updated_at: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.MeResponse: properties: active: type: boolean display_name: type: string email: type: string groups: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO type: array uniqueItems: false id: type: string issuer: type: string source: type: string subject: type: string user_name: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.MembersResponse: properties: direct_child_groups: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO type: array uniqueItems: false next_groups_cursor: type: string next_users_cursor: type: string prev_groups_cursor: type: string prev_users_cursor: type: string transitive_users: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.UserDTO type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.MetadataResponse: properties: created_at: type: string entity_id: type: string entity_kind: type: string metadata: type: object updated_at: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.OAuth2ConfigDTO: properties: authorization_endpoint: type: string client_id: type: string client_secret: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ClientSecretRefDTO dcr: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.DCRConfigDTO redirect_uri: type: string scopes: items: type: string type: array uniqueItems: false token_endpoint: type: string token_endpoint_auth_method: description: >- TokenEndpointAuthMethod carries the same meaning and the same refusal as OIDCConfigDTO's. It is on both arms because neither can derive it: OIDC discovery advertises what a provider SUPPORTS, not which form this client is registered for. type: string required: - authorization_endpoint - token_endpoint type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.OBOAuthDTO: properties: audience: type: string authority: type: string cache_skew: description: >- CacheSkew renders the domain's *time.Duration as its Go duration string (e.g. "5m"), or is absent when unset — the OBO cache applies its own skew at dial time, so absence is meaningful (ADR-0024). type: string client_id: type: string provider_id: type: string scopes: items: type: string type: array uniqueItems: false tenant_id: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.OBOAuthRequest: properties: audience: type: string authority: type: string cache_skew: description: >- CacheSkew is an optional Go duration string (e.g. "5m"); the mapper parses it into the domain's *time.Duration. Absent means "no override". type: string client_id: type: string client_secret: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ClientSecretRefDTO provider_id: type: string scopes: items: type: string type: array uniqueItems: false tenant_id: type: string required: - client_id - provider_id - tenant_id type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.OIDCConfigDTO: properties: additional_authorization_params: additionalProperties: type: string description: >- AdditionalAuthorizationParams are extra query parameters some providers require on /authorize. type: object allow_private_ips: description: >- AllowPrivateIPs relaxes the consumer's dial-time private-address guard, for a provider reachable only inside the cluster. type: boolean client_id: type: string client_secret: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ClientSecretRefDTO dcr: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.DCRConfigDTO issuer_url: type: string redirect_uri: type: string scopes: items: type: string type: array uniqueItems: false subject_claim: description: >- SubjectClaim names the claim upstream identity is keyed on. Empty means the consumer's default (`sub`); a provider that carries identity elsewhere is keyed on the wrong value without it. type: string token_endpoint_auth_method: description: >- TokenEndpointAuthMethod decides the credential form the consumer sends to the token endpoint. Empty means unspecified (the consumer's default); anything other than client_secret_basic or client_secret_post is refused at construction, because sending the wrong form fails at the upstream rather than here. type: string required: - issuer_url type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.PatchGroupRequest: properties: description: type: string display_name: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.RoleMappingDTO: properties: claim: type: string matcher: type: string priority: type: integer role_arn: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.RoleMappingRequest: properties: claim: type: string matcher: type: string priority: type: integer role_arn: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.SetConnectionEnabledRequest: properties: enabled: type: boolean required: - enabled type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.SetConnectionToolPolicyRequest: properties: tools_enabled_by_default: type: boolean tools_exception_list: items: type: string type: array uniqueItems: false required: - tools_enabled_by_default type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.SetConnectorPolicyDocumentRequest: properties: document: type: string required: - document type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.TokenExchangeAuthDTO: properties: audience: type: string client_id: type: string client_secret_configured: type: boolean external_token_header_name: type: string provider_id: type: string scopes: items: type: string type: array uniqueItems: false subject_token_type: type: string token_url: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.TokenExchangeAuthRequest: properties: audience: type: string client_id: type: string client_secret: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ClientSecretRefDTO external_token_header_name: type: string provider_id: type: string scopes: items: type: string type: array uniqueItems: false subject_token_type: type: string token_url: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.UpstreamInjectAuthDTO: properties: provider_id: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.UpstreamInjectAuthRequest: properties: provider_id: type: string required: - provider_id type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.UserDTO: properties: active: type: boolean created_at: type: string display_name: type: string email: type: string id: type: string photo_url: type: string source: type: string updated_at: type: string user_name: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.XAAAuthDTO: properties: idp_client_id: type: string idp_token_url: type: string insecure_target_token_url: type: boolean provider_id: type: string scopes: items: type: string type: array uniqueItems: false subject_token_type: type: string target_audience: type: string target_client_id: type: string target_resource: type: string target_token_url: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.XAAAuthRequest: properties: idp_client_id: type: string idp_client_secret: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ClientSecretRefDTO idp_token_url: type: string insecure_target_token_url: type: boolean provider_id: type: string scopes: items: type: string type: array uniqueItems: false subject_token_type: type: string target_audience: type: string target_client_id: type: string target_client_secret: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ClientSecretRefDTO target_resource: type: string target_token_url: type: string required: - provider_id type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ConnectorUsageResponse: properties: connector_id: type: string connector_name: type: string group_series: description: |- GroupSeries is built from the call-time group snapshot on each recorded call. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.GroupUsageSeriesDTO type: array uniqueItems: false tool_call_count: type: integer type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.DimensionCountDTO: properties: key: type: string tool_call_count: type: integer type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ExportToolCallUsageResponse: properties: checkpoints: description: |- Checkpoints carries the signed hash-chain checkpoints (D12) covering the sequence positions spanned by Records. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.IntegrityCheckpointDTO type: array uniqueItems: false next_cursor: description: NextCursor pages forward; empty on the last page. type: string records: description: Records is one page, oldest first. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ExportedToolCallUsageDTO type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ExportedToolCallUsageDTO: properties: chain_id: description: >- ChainID identifies the hash chain this record belongs to. Chains are per RFC Appendix G's per-stream chaining, and a stream is exactly one gateway_id — not one (gateway_id, environment) pair (see the metering module's migration 000003: "Stream = gateway_id ... environment is a field the hash covers, not a chain split"). Every record ExportQuery returns shares the same ChainID, since gateway_id is a required export filter: this field identifies the chain for an external verifier's own bookkeeping, not something a response ever needs to group multiple values of. Because a chain spans every environment of one gateway, an export filtered by environment returns a subsequence of that one chain, and Sequence gaps between the returned records are then EXPECTED — they are the omitted other-environment records, not a deletion signal. Grouping by ChainID cannot distinguish the two cases, because there is only one ChainID to group by. Gap-based deletion detection (D12) is meaningful only on an export with no environment filter; pull the unfiltered export (and filter client-side) when that property matters. See ExportToolCallUsageResponse's doc for the corresponding ordering guarantee. type: string id: description: ID is the metering store's record id. type: string prev_hash: description: PrevHash is empty for a chain's first record. type: string record_hash: type: string sequence: description: Sequence is this record's position within ChainID's hash chain. type: integer usage: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ToolCallUsageDTO type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.GroupRefDTO: properties: id: type: string name: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.GroupUsageSeriesDTO: properties: group: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.GroupRefDTO points: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TimeSeriesPointDTO type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.IntegrityCheckpointDTO: properties: chain_hash: type: string chain_id: description: >- ChainID is the hash chain (see ExportedToolCallUsageDTO.ChainID) this checkpoint covers. type: string hash_alg: description: >- HashAlg names the algorithm ChainHash (and each record's RecordHash in this checkpoint's span) was computed with, e.g. "SHA-256" (models.HashAlgorithm, the only value emitted today). Carried explicitly, rather than assumed fixed, so the hash can move without a contract break. type: string key_id: description: >- KeyID identifies which key signed this checkpoint, so a verifier can look up the right public key after rotation. SignedAt alone cannot serve this purpose: it is checkpoint metadata, not a trust anchor, and key-validity windows do not necessarily align with it. type: string sequence: description: |- Sequence is the chain position this checkpoint covers up to (inclusive). type: integer sig_alg: description: >- SigAlg names the signature algorithm, e.g. "ES256" (the JWA name for ECDSA P-256/SHA-256, the only signer the metering module has today — see internal/platform/signing.ES256Signer). Carried explicitly for the same reason as HashAlg: so a second signing scheme would not be a contract break. type: string signature: type: string signed_at: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ListCallsResponse: properties: next_cursor: description: NextCursor pages forward (older); empty on the last page. type: string prev_cursor: description: >- PrevCursor pages backward (newer); empty on the first page. Pass it as the `before` query param, never as `cursor` — the two are mutually exclusive. type: string records: description: Records is one page, newest first by occurred_at. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ToolCallUsageDTO type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TimeSeriesPointDTO: properties: bucket_start: type: string tool_call_count: type: integer type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ToolCallUsageDTO: properties: billable: type: boolean billable_reason: type: string call_id: description: >- CallID correlates every attempt at one logical tool call (the original invocation and any retry of it); empty when the call is not a retry. type: string category: description: >- Category is one of: invocation, allowed, denied, customer_retry, internal, health_check, admin, platform_retry, not_evaluated, support (Appendix E's `category` column values). The canonical mapping from the ToolCallUsage proto enum to these wire strings is a #2344 concern: the domain model owns the Decision/Outcome/Category value objects (their real business meaning and any invariants), and the app-layer mapper (contracts <-> domain/models, per enterprise-modulith-modules.md) is what converts a domain value to this DTO's wire string on export — not this transport package, which only declares the shape. type: string connector_id: type: string connector_name: type: string decision: description: >- Decision is "allowed" or "denied", or "unspecified" for a record whose Category has no decision (health_check, internal, admin, not_evaluated; also the fallback for the proto's DECISION_UNSPECIFIED). Not omitempty: "unspecified" is always written explicitly rather than left absent, so a decision breakdown (DimensionCountDTO.Key) always has a defined key. type: string definition_version: type: string environment: type: string gateway_id: type: string groups: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.GroupRefDTO type: array uniqueItems: false occurred_at: type: string outcome: description: >- Outcome is "ok" or "error", or "unspecified" for a record whose Category has no outcome (same set as Decision above; also the fallback for the proto's OUTCOME_UNSPECIFIED). Not omitempty, for the same reason as Decision. type: string tool_name: type: string user_email: description: |- UserEmail is the display email resolved from UserID (ADR-0025), empty when unresolved (no resolver wired, or an authoritative miss) — the caller renders UserID's raw UUID in that case. Distinct from UserID: this is a read-time enrichment, never a stored field. type: string user_id: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TopConnectorDTO: properties: connector_id: type: string connector_name: type: string tool_call_count: type: integer type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TopConnectorsResponse: properties: connectors: description: Connectors is ordered by ToolCallCount descending. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TopConnectorDTO type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TopToolDTO: properties: connector_id: type: string connector_name: type: string tool_call_count: type: integer tool_name: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TopToolsResponse: properties: tools: description: Tools is ordered by ToolCallCount descending. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TopToolDTO type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UsageSummaryResponse: properties: active_user_count: type: integer tool_call_count: type: integer type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UsageTimeBucketDTO: properties: breakdown: description: |- Breakdown is grouped by UsageTimeSeriesResponse.Dimension; omitted when no dimension was requested. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.DimensionCountDTO type: array uniqueItems: false bucket_start: type: string tool_call_count: type: integer type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UsageTimeSeriesResponse: properties: bucket_width_seconds: description: >- BucketWidthSeconds is uniform across Buckets; a bucket's ToolCallCount and Breakdown cover exactly this many seconds starting at BucketStart, so a single bucket is interpretable without the rest of the series. type: integer buckets: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UsageTimeBucketDTO type: array uniqueItems: false dimension: description: |- Dimension is the breakdown grouping applied to each bucket's Breakdown, or empty when no breakdown was requested. One of: environment, tool, decision, connector. type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UserConnectorUsageDTO: properties: connector_id: type: string connector_name: type: string last_activity: type: string tool_call_count: type: integer tools: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UserToolUsageDTO type: array uniqueItems: false type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UserToolUsageDTO: properties: last_activity: type: string tool_call_count: type: integer tool_name: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UserUsageResponse: properties: connectors: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UserConnectorUsageDTO type: array uniqueItems: false last_activity: description: LastActivity is nil when the user made no call in the range. type: string series: description: |- Series is zero-filled across the range so the chart axis stays continuous. items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TimeSeriesPointDTO type: array uniqueItems: false tool_call_count: type: integer user_id: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.CACertConfig: description: Custom CA certificate configuration (PEM inline or by URL). properties: pem: type: string url: type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.DegradedModeConfig: description: Governs client behaviour when the config server is unreachable. properties: grace_period: description: |- GracePeriod is the duration before the policy takes effect. Expressed as a Go duration string, e.g. "24h", "30m". type: string message: description: >- Message is an optional human-readable message shown to the user during degraded mode. type: string policy: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.DegradedModePolicy type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.DegradedModePolicy: description: |- Policy determines the behaviour when the server is unreachable. One of "warn" or "block_new". enum: - warn - block_new type: string x-enum-varnames: - DegradedModePolicyWarn - DegradedModePolicyBlockNew github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-bool: description: |- Assistant controls whether the cloud UI shows the built-in AI assistant. When enforced with value false, clients must hide the Assistant. properties: enforcement: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Enforcement value: type: boolean type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config_CACertConfig: properties: enforcement: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Enforcement value: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.CACertConfig type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config_GatewayConfig: description: |- Gateway carries the LLM Gateway URLs (see GatewayConfig). When the directive is present and api_url is set, the cloud-UI enables the budget management UI. properties: enforcement: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Enforcement value: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.GatewayConfig type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config_RegistryConfig: properties: enforcement: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Enforcement value: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.RegistryConfig type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config_TelemetryConfig: properties: enforcement: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Enforcement value: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.TelemetryConfig type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Enforcement: description: Controls whether a configuration directive is mandatory or advisory. enum: - enforced - default type: string x-enum-varnames: - EnforcementEnforced - EnforcementDefault github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.EnterpriseConfig: description: Full enterprise-governed configuration payload. properties: assistant: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-bool build_env: type: object ca_certificate: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config_CACertConfig degraded_mode: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.DegradedModeConfig gateway: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config_GatewayConfig help_menu: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-bool non_registry_servers: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-bool playground: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-bool registry: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config_RegistryConfig telemetry: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.Directive-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config_TelemetryConfig type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.GatewayConfig: description: LLM Gateway connection settings (management API + user-facing proxy). properties: api_url: description: >- APIURL is the server-to-server management API base URL used by cloud-UI for budget management, model catalog, etc. type: string proxy_url: description: >- ProxyURL is the user-facing LLM proxy endpoint surfaced in the cloud-UI "My Usage" page (banner + `thv llm setup --gateway-url`). type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.RegistryConfig: description: Enterprise registry connection settings. properties: allow_private_ip: type: boolean api_url: description: |- APIURL is the registry API endpoint for ToolHive clients (thv CLI/desktop) — typically scoped to a single registry (e.g. `https://registry.example.com/registry/toolhive`). type: string server_api_url: description: |- ServerAPIURL is the registry-server API root used by the cloud-UI web console (root-relative `/v1` and `/registry/{name}/v0.1` paths). type: string type: object github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.TelemetryConfig: description: Enterprise OpenTelemetry settings. properties: headers: additionalProperties: type: string description: >- Headers carries non-sensitive headers only (e.g. tenant ID, environment). Do not include API keys, tokens, or other credentials. type: object insecure: type: boolean metrics_enabled: type: boolean otel_endpoint: type: string sampling_rate: type: number tracing_enabled: type: boolean type: object internal_config-server_httpserver.configResponse: description: Signed configuration envelope. properties: config: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.EnterpriseConfig degraded_mode: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_internal_config-server_config.DegradedModeConfig etag: example: sha256:abc123 type: string issued_at: type: string not_after: type: string refresh_interval: example: 5m0s type: string schema_version: example: '1' type: string signature: type: string type: object internal_config-server_httpserver.oauthProtectedResourceMetadata: properties: authorization_servers: items: type: string type: array uniqueItems: false bearer_methods_supported: items: type: string type: array uniqueItems: false jwks_uri: type: string resource: type: string scopes_supported: items: type: string type: array uniqueItems: false type: object internal_config-server_httpserver.toolhiveConfigurationMetadata: properties: client_id: description: >- ClientID is the OIDC client ID of the public (PKCE, no secret) application registered by the administrator for CLI and desktop clients. This is safe to advertise because public clients carry no secret. Omitted when not configured; clients must then obtain the client ID by other means. type: string config_endpoint: description: >- ConfigEndpoint is the absolute URL clients use to fetch their enterprise config. type: string issuer: description: >- Issuer is the OIDC issuer URI. Clients use this to fetch the OIDC discovery document and initiate the auth flow. Omitted when OIDC is not configured. type: string jwks_uri: description: >- JWKSURI is the absolute URL of the public key set used to verify signed envelopes. type: string oauth_protected_resource: description: >- OAuthProtectedResource is the absolute URL of the RFC 9728 protected-resource metadata endpoint. Clients follow this link to discover the authorization server and required scopes. Omitted when the server's resource URL is not configured. type: string scopes_supported: description: >- ScopesSupported lists the OAuth scopes required to call the config endpoint. Clients include these when requesting a token from the authorization server. Omitted when no specific scope is required. items: type: string type: array uniqueItems: false type: object internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_ConnectionDTO: properties: items: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectionDTO type: array uniqueItems: false next_cursor: type: string prev_cursor: type: string type: object internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_ConnectorDTO: properties: items: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorDTO type: array uniqueItems: false next_cursor: type: string prev_cursor: type: string type: object internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_ConnectorIdentityProviderDTO: properties: items: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorIdentityProviderDTO type: array uniqueItems: false next_cursor: type: string prev_cursor: type: string type: object internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_GroupDTO: properties: items: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO type: array uniqueItems: false next_cursor: type: string prev_cursor: type: string type: object internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_ManagedSecretDTO: properties: items: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ManagedSecretDTO type: array uniqueItems: false next_cursor: type: string prev_cursor: type: string type: object internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_UserDTO: properties: items: items: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.UserDTO type: array uniqueItems: false next_cursor: type: string prev_cursor: type: string type: object securitySchemes: BearerAuth: description: Bearer token from OIDC provider in: header name: Authorization type: apiKey info: description: >- Stacklok Enterprise Manager — unified admin API for configuration delivery, directory, and budget management. title: Enterprise Manager API version: 0.1.0 externalDocs: description: '' url: '' paths: /.well-known/jwks.json: get: description: Returns the JSON Web Key Set for verifying signed config envelopes. responses: '200': content: application/json: schema: type: object description: JSON Web Key Set '503': content: application/json: schema: additionalProperties: type: string type: object description: signing not configured summary: Get JWKS tags: - security /.well-known/oauth-protected-resource: get: description: Returns RFC 9728 metadata describing this protected resource. responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_config-server_httpserver.oauthProtectedResourceMetadata description: OK '404': description: resource URL not configured summary: OAuth protected resource metadata tags: - discovery /.well-known/toolhive-configuration: get: description: Returns a discovery document for ToolHive client bootstrap. responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_config-server_httpserver.toolhiveConfigurationMetadata description: OK summary: ToolHive configuration discovery tags: - discovery /api/v1beta/config: get: description: >- Returns the signed enterprise configuration envelope for the calling client. parameters: - description: Client type in: header name: X-Client-Type required: true schema: enum: - toolhive-desktop - toolhive-cli - toolhive-cloud-ui type: string - description: Client version (semver, e.g. 1.2.3) in: header name: X-Client-Version required: true schema: type: string - description: ETag for conditional GET (RFC 7232) in: header name: If-None-Match schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_config-server_httpserver.configResponse description: OK headers: ETag: description: Strong ETag of the config payload schema: type: string '304': description: Config unchanged (ETag match) '400': content: application/json: schema: additionalProperties: type: string type: object description: Invalid or missing required header '503': content: application/json: schema: additionalProperties: type: string type: object description: Signing not configured security: - BearerAuth: [] summary: Get enterprise configuration tags: - config /healthz: get: responses: '200': content: application/json: schema: additionalProperties: type: string type: object description: OK summary: Health check tags: - health /readyz: get: responses: '200': content: application/json: schema: additionalProperties: type: string type: object description: OK '503': content: application/json: schema: additionalProperties: type: string type: object description: Service Unavailable summary: Readiness check tags: - health /v1/budgets: get: responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.GetBudgetsResponse description: OK '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get budgets tags: - budgets put: parameters: - description: ETag from GET /v1/budgets in: header name: If-Match schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.SetBudgetsRequest summary: body description: Complete budget collection description: Complete budget collection required: true responses: '204': description: Budgets applied '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Precondition Failed '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Set budgets tags: - budgets /v1/budgets/breakdown: get: description: >- One budget's current-period spend broken down by user, model, and provider. The period window is computed server-side (current period only). Each dimension's entries sum to total_used_usd. parameters: - description: Principal tier in: query name: scope required: true schema: enum: - user - group type: string - description: >- Budget subject id (OIDC sub for user budgets, group UUID for group budgets) in: query name: subject_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.BreakdownResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Budget consumption breakdown tags: - budgets /v1/budgets/charges: get: parameters: - description: Inclusive event_time lower bound, RFC 3339 in: query name: from schema: type: string - description: Exclusive event_time upper bound, RFC 3339 in: query name: to schema: type: string - description: Served model of the underlying event, exact match in: query name: model schema: type: string - description: Payer tier charged in: query name: scope schema: enum: - user - group type: string - description: Payer charged, exact match in: query name: subject_id schema: type: string - description: Opaque keyset cursor from a previous page in: query name: cursor schema: type: string - description: Page size (default 50, max 10000, clamped) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ListChargesResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List charges tags: - budgets /v1/budgets/default: delete: responses: '204': description: Default user budget cleared '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete default user budget tags: - budgets get: responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.GetDefaultUserBudgetResponse description: OK '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get default user budget tags: - budgets put: requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PutDefaultUserBudgetRequest summary: body description: Default user budget specification description: Default user budget specification required: true responses: '204': description: Default user budget applied '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Put default user budget tags: - budgets /v1/budgets/events: get: parameters: - description: Inclusive event_time lower bound, RFC 3339 in: query name: from schema: type: string - description: Exclusive event_time upper bound, RFC 3339 in: query name: to schema: type: string - description: Served model, exact match in: query name: model schema: type: string - description: Verified OIDC subject, exact match in: query name: auth_subject schema: type: string - description: Interaction outcome in: query name: outcome schema: enum: - delivered - blocked_downstream - client_disconnect - upstream_error type: string - description: Opaque keyset cursor from a previous page in: query name: cursor schema: type: string - description: Page size (default 50, max 10000, clamped) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ListEventsResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List usage events tags: - budgets /v1/budgets/groups/{id}: delete: parameters: - description: ETag from GET /v1/budgets in: header name: If-Match schema: type: string - description: Group subject_id in: path name: id required: true schema: type: string responses: '204': description: Group budget removed '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Precondition Failed '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete group budget tags: - budgets get: description: >- A group budget's current-period spend sliced by one dimension. dimension selects the slice axis; entries sum to total_used_usd. parameters: - description: Group subject_id in: path name: id required: true schema: type: string - description: Slice axis in: query name: dimension required: true schema: enum: - user - model type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.DimensionSliceResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Group budget breakdown slice tags: - budgets put: parameters: - description: ETag from GET /v1/budgets in: header name: If-Match schema: type: string - description: Group subject_id in: path name: id required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PutGroupBudgetRequest summary: body description: Group budget specification description: Group budget specification required: true responses: '204': description: Group budget applied '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Precondition Failed '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Put group budget tags: - budgets /v1/budgets/pricing: get: responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.GetPricingResponse description: OK headers: ETag: description: Validator identifying the pricing catalog version that was read schema: type: string '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get active pricing catalog tags: - budgets /v1/budgets/pricing/entries/{provider}/{model}: delete: description: >- Remove one (provider, model) rate row outright. There is no revert-to-baseline: the next request for that model is denied at admission as unpriceable. This republishes the ENTIRE remaining catalog as a new operator-dated version, permanently opting this deployment out of baseline updates shipped later. parameters: - description: ETag from GET /v1/budgets/pricing or the per-entry GET in: header name: If-Match required: true schema: type: string - description: Literal provider as stored in: path name: provider required: true schema: type: string - description: Model name (may contain '/') in: path name: model required: true schema: type: string responses: '204': description: Pricing catalog entry removed '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Conflict '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Precondition Failed '428': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Precondition Required '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete pricing catalog entry tags: - budgets get: parameters: - description: Literal provider as stored in: path name: provider required: true schema: type: string - description: Model name (may contain '/') in: path name: model required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.GetPricingEntryResponse description: OK headers: ETag: description: >- Catalog version this entry was read from; send it as If-Match on a write schema: type: string '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get pricing catalog entry tags: - budgets put: description: >- Upsert one (provider, model) rate row. The body must carry exactly one of anthropic / openai / google. This republishes the ENTIRE merged catalog as a new operator-dated version: the first per-entry edit permanently opts this deployment out of built-in pricing baseline updates shipped in later releases, and a model only a newer baseline prices is then denied at admission as unpriceable. parameters: - description: ETag from GET /v1/budgets/pricing or the per-entry GET in: header name: If-Match required: true schema: type: string - description: Literal provider to store under in: path name: provider required: true schema: type: string - description: Model name (may contain '/') in: path name: model required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PutPricingEntryRequest summary: body description: Rate block for this entry description: Rate block for this entry required: true responses: '204': description: Pricing catalog entry upserted '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Conflict '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Precondition Failed '428': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Precondition Required '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Put pricing catalog entry tags: - budgets /v1/budgets/pricing/versions/{effectiveFrom}: delete: description: >- Remove a pricing catalog version staged to take effect later, addressed by its exact effective_from. Clears the 409 a staged version causes on every pricing write. A version that has already taken effect cannot be removed and returns 409. parameters: - description: Staged version's effective_from, RFC 3339 in: path name: effectiveFrom required: true schema: type: string responses: '204': description: Staged pricing catalog version removed '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete staged pricing catalog version tags: - budgets /v1/budgets/spend: get: description: >- Zero-filled daily USD totals over the served window, including the current (in-progress) UTC day. from/to echo the bounds actually served after clamping (to at the end of the current UTC day, from at the retention horizon). parameters: - description: Bucket granularity in: query name: granularity schema: enum: - day type: string - description: Window start, ISO date (default 30 days back, including today) in: query name: from schema: type: string - description: Window end (exclusive), ISO date in: query name: to schema: type: string - description: Served model of the underlying event, exact match in: query name: model schema: type: string - description: Payer tier charged in: query name: scope schema: enum: - user - group type: string - description: Payer charged, exact match in: query name: subject_id schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.SpendSeriesResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Daily spend series tags: - budgets /v1/budgets/spend/export: get: description: >- A grouped, bucketed rollup of charge records as CSV, sorted bucket ascending then charged_usd descending then group key(s) ascending. A single group_by dimension renders a fixed "group_key" column; two or more render one named column per dimension, in the order given. The served window (after default/retention clamping) is echoed in the X-Spend-Export-From/To response headers. Experiment-gated; 404s when the operator has not enabled it. parameters: - description: >- Comma-separated grouping dimensions, e.g. user,model. Each must be one of user, model, provider, with no repeats. Defaults to user. in: query name: group_by schema: type: string - description: Bucket width in: query name: granularity schema: enum: - day - week - month type: string - description: >- Window start, RFC 3339 or YYYY-MM-DD (default 30 days back, including today) in: query name: from schema: type: string - description: Window end (exclusive), RFC 3339 or YYYY-MM-DD in: query name: to schema: type: string - description: >- Filter: served model of the underlying event, exact match. Narrows which charges are included; does not change the grouping — use group_by for that in: query name: model schema: type: string - description: 'Filter: payer tier charged' in: query name: scope schema: enum: - user - group type: string - description: 'Filter: payer charged, exact match' in: query name: subject_id schema: type: string responses: '200': content: text/csv: schema: type: string description: >- CSV: bucket,group_key,charge_count,charged_usd for one group_by dimension; bucket,,,...,charge_count,charged_usd for two or more '400': content: text/csv: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '500': content: text/csv: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Spend export (CSV) tags: - budgets /v1/budgets/summary: get: parameters: - description: Principal tier filter in: query name: scope schema: enum: - user - group type: string - description: Subject id prefix match in: query name: subject schema: type: string - description: >- Instant the period windows are computed against, RFC 3339 (default now) in: query name: at schema: type: string - description: Opaque keyset cursor from a previous page in: query name: cursor schema: type: string - description: Page size (default 50, max 200, clamped) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.SummaryResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Budget cells summary tags: - budgets /v1/budgets/users/{id}: delete: parameters: - description: ETag from GET /v1/budgets in: header name: If-Match schema: type: string - description: User subject_id in: path name: id required: true schema: type: string responses: '204': description: User budget removed '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Precondition Failed '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete user budget tags: - budgets get: description: >- A user's spend sliced by one dimension. dimension=model is the current-period spend on the user's own budget; dimension=group is every group budget the user belongs to or has contributed to (no single period window). Entries sum to total_used_usd. parameters: - description: User subject_id in: path name: id required: true schema: type: string - description: Slice axis in: query name: dimension required: true schema: enum: - model - group type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.DimensionSliceResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: User budget breakdown slice tags: - budgets put: parameters: - description: ETag from GET /v1/budgets in: header name: If-Match schema: type: string - description: User subject_id in: path name: id required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.PutUserBudgetRequest summary: body description: User budget specification description: User budget specification required: true responses: '204': description: User budget applied '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Precondition Failed '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Put user budget tags: - budgets /v1/connections/{id}: get: parameters: - description: Connection UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectionDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get connection tags: - directory /v1/connector-identity-providers: get: responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_ConnectorIdentityProviderDTO description: OK '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List connector identity providers tags: - directory post: requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateConnectorIdentityProviderRequest summary: body description: Identity provider to create description: Identity provider to create required: true responses: '201': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorIdentityProviderDTO description: Created '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Create connector identity provider tags: - directory /v1/connector-identity-providers/{id}: delete: parameters: - description: IdentityProvider UUID in: path name: id required: true schema: type: string responses: '204': description: No Content '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete connector identity provider tags: - directory get: parameters: - description: IdentityProvider UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorIdentityProviderDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get connector identity provider tags: - directory put: parameters: - description: IdentityProvider UUID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateConnectorIdentityProviderRequest summary: body description: Identity provider's new state description: Identity provider's new state required: true responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorIdentityProviderDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Update connector identity provider tags: - directory /v1/connectors/{id}/policy: get: parameters: - description: Connector UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorPolicyDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get connector policy tags: - directory /v1/connectors/{id}/policy/cedar-mode: delete: parameters: - description: Connector UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorPolicyDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Precondition Failed '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Switch a connector policy back to structured authoring mode tags: - directory put: parameters: - description: Connector UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorPolicyDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Precondition Failed '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Switch a connector policy to Cedar authoring mode tags: - directory /v1/connectors/{id}/policy/document: put: parameters: - description: Connector UUID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.SetConnectorPolicyDocumentRequest summary: body description: Cedar document description: Cedar document required: true responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorPolicyDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Precondition Failed '413': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Request Entity Too Large '422': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unprocessable Entity '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Set a connector policy's Cedar document tags: - directory /v1/connectors/{id}/policy/groups: put: parameters: - description: Connector UUID in: path name: id required: true schema: type: string - description: ETag from GET /v1/connectors/{id}/policy in: header name: If-Match required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GrantConnectorPolicyUserGroupsRequest summary: body description: User group ids description: User group ids required: true responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorPolicyDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Precondition Failed '413': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Request Entity Too Large '422': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unprocessable Entity '428': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Precondition Required '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Replace a connector policy's granted user groups tags: - directory /v1/connectors/{id}/policy/groups/{group_id}: delete: parameters: - description: Connector UUID in: path name: id required: true schema: type: string - description: User group UUID in: path name: group_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorPolicyDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Precondition Failed '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Revoke a user group's access to a connector tags: - directory /v1/gateways/{gateway_id}/connectors: get: parameters: - description: Connector-gateway install id in: path name: gateway_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_ConnectorDTO description: OK '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List connectors tags: - directory post: parameters: - description: Connector-gateway install id in: path name: gateway_id required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorWriteRequest summary: body description: Connector to create description: Connector to create required: true responses: '201': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorDTO description: Created '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Create connector tags: - directory /v1/gateways/{gateway_id}/connectors/{id}: delete: parameters: - description: Connector-gateway install id in: path name: gateway_id required: true schema: type: string - description: Connector UUID in: path name: id required: true schema: type: string responses: '204': description: No Content '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete connector tags: - directory get: parameters: - description: Connector-gateway install id in: path name: gateway_id required: true schema: type: string - description: Connector UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get connector tags: - directory put: parameters: - description: Connector-gateway install id in: path name: gateway_id required: true schema: type: string - description: Connector UUID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorWriteRequest summary: body description: Connector's new state description: Connector's new state required: true responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Update connector tags: - directory /v1/gateways/{gateway_id}/connectors/{id}/connections: get: parameters: - description: Connector-gateway install id in: path name: gateway_id required: true schema: type: string - description: Connector UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_ConnectionDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List connector connections tags: - directory /v1/gateways/{gateway_id}/discovered-servers: get: description: >- Lists the MCP servers the cluster is running as candidates a connector could be admitted from, each carrying the connectors on this gateway that already hold its endpoint. parameters: - description: Connector-gateway install id in: path name: gateway_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.DiscoveredServerListResponse description: OK '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error '503': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Service Unavailable security: - BearerAuth: [] summary: List discovered MCP servers tags: - directory /v1/groups: get: parameters: - description: Filter by group name in: query name: name schema: type: string - description: Filter by display name in: query name: display_name schema: type: string - description: Filter by provisioning source (e.g. scim) in: query name: source schema: type: string - description: Case-insensitive substring search across display_name and name in: query name: search schema: type: string - description: >- Opaque pagination cursor — pages forward from here (mutually exclusive with before) in: query name: cursor schema: type: string - description: >- Opaque pagination cursor — pages backward from here (mutually exclusive with cursor) in: query name: before schema: type: string - description: Maximum items to return (default 50, max 200) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_GroupDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List groups tags: - directory post: requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateGroupRequest summary: body description: Group to create description: Group to create required: true responses: '201': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO description: Created '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Create group tags: - directory /v1/groups/{group_id}/subgroups/{child_id}: delete: parameters: - description: Group UUID in: path name: group_id required: true schema: type: string - description: Child group UUID in: path name: child_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Remove subgroup tags: - directory put: parameters: - description: Group UUID in: path name: group_id required: true schema: type: string - description: Child group UUID in: path name: child_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Add subgroup tags: - directory /v1/groups/{group_id}/users/{user_id}: delete: parameters: - description: Group UUID in: path name: group_id required: true schema: type: string - description: User UUID in: path name: user_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Remove user member tags: - directory put: parameters: - description: Group UUID in: path name: group_id required: true schema: type: string - description: User UUID in: path name: user_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Add user member tags: - directory /v1/groups/{id}: delete: parameters: - description: Group UUID in: path name: id required: true schema: type: string responses: '204': description: No Content '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete group tags: - directory get: parameters: - description: Group UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get group tags: - directory patch: parameters: - description: Group UUID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.PatchGroupRequest summary: body description: Fields to update description: Fields to update required: true responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.GroupDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '412': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Precondition Failed '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Patch group tags: - directory /v1/groups/{id}/members: get: parameters: - description: Group UUID in: path name: id required: true schema: type: string - description: Maximum items per collection (default 50, max 200) in: query name: limit schema: type: integer - description: >- Opaque cursor — pages the transitive-users collection forward (mutually exclusive with users_before) in: query name: users_cursor schema: type: string - description: >- Opaque cursor — pages the transitive-users collection backward (mutually exclusive with users_cursor) in: query name: users_before schema: type: string - description: >- Opaque cursor — pages the direct-child-groups collection forward (mutually exclusive with groups_before) in: query name: groups_cursor schema: type: string - description: >- Opaque cursor — pages the direct-child-groups collection backward (mutually exclusive with groups_cursor) in: query name: groups_before schema: type: string - description: >- Filter the transitive-users collection by active status (direct_child_groups is unaffected) in: query name: active schema: type: boolean - description: >- Case-insensitive substring search: display_name/user_name/email on the transitive-users collection, display_name/name on the direct-child-groups collection in: query name: search schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.MembersResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get group members tags: - directory /v1/groups/{id}/metadata: delete: parameters: - description: Group UUID in: path name: id required: true schema: type: string responses: '204': description: No Content '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete group metadata tags: - directory get: parameters: - description: Group UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.MetadataResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get group metadata tags: - directory put: parameters: - description: Group UUID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: type: object text/plain: schema: title: body type: object description: Metadata JSON document required: true responses: '204': description: No Content '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Put group metadata tags: - directory /v1/keys: get: description: |- Returns every key owned by the authenticated caller. Never includes key secrets or hashes. responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ListKeysResponse description: OK '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error x-required-role: authenticated security: - BearerAuth: [] summary: List the caller's virtual API keys tags: - Keys post: description: |- Mints a key tied to the authenticated caller's OIDC identity. The full plaintext secret is returned ONLY in this response — it is never retrievable afterwards. Ownership is derived from the caller's token, not the request body. requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateKeyRequest summary: body description: Key creation parameters description: Key creation parameters required: true responses: '201': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateKeyResponse description: Created '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error x-required-role: authenticated security: - BearerAuth: [] summary: Create a virtual API key tags: - Keys /v1/keys/{id}: delete: description: |- Permanently invalidates the key. This cannot be undone — a revoked key can never be re-enabled. parameters: - description: Key short ID in: path name: id required: true schema: type: string responses: '204': description: Key revoked '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error x-required-role: authenticated security: - BearerAuth: [] summary: Revoke one of the caller's virtual API keys tags: - Keys get: description: |- Never includes key secrets or hashes. Returns 404 (not 403) when the id exists but is owned by another caller, so key existence is not leaked across owners. parameters: - description: Key short ID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.KeyDTO description: OK '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error x-required-role: authenticated security: - BearerAuth: [] summary: Get one of the caller's virtual API keys tags: - Keys /v1/keys/{id}/disable: post: description: |- Temporarily deactivates a key. Reversible via the enable endpoint, unlike revocation. parameters: - description: Key short ID in: path name: id required: true schema: type: string responses: '204': description: Key disabled '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error x-required-role: authenticated security: - BearerAuth: [] summary: Disable one of the caller's virtual API keys tags: - Keys /v1/keys/{id}/enable: post: description: |- Moves a disabled key back to active. Re-enabling a revoked key is rejected with 409 — revocation is permanent. parameters: - description: Key short ID in: path name: id required: true schema: type: string responses: '204': description: Key enabled '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error x-required-role: authenticated security: - BearerAuth: [] summary: Re-enable one of the caller's disabled virtual API keys tags: - Keys /v1/keys/{id}/rotate: post: description: |- Generates a new secret for the same key ID. The old secret keeps validating for a 24h grace period so in-flight callers can pick up the new secret. The new plaintext secret is returned only once. parameters: - description: Key short ID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateKeyResponse description: OK '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error x-required-role: authenticated security: - BearerAuth: [] summary: Rotate one of the caller's virtual API keys tags: - Keys /v1/managed-secrets: get: responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_ManagedSecretDTO description: OK '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List managed secrets tags: - directory post: requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateManagedSecretRequest summary: body description: Managed secret to create description: Managed secret to create required: true responses: '201': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ManagedSecretDTO description: Created '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error '503': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Service Unavailable security: - BearerAuth: [] summary: Create managed secret tags: - directory /v1/managed-secrets/{id}: delete: parameters: - description: ManagedSecret UUID in: path name: id required: true schema: type: string responses: '204': description: No Content '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete managed secret tags: - directory get: parameters: - description: ManagedSecret UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ManagedSecretDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get managed secret tags: - directory /v1/me: get: description: |- Returns the authenticated caller's directory profile and transitive group membership, resolved from their verified token rather than a path parameter. An authenticated caller with no directory binding (never provisioned, or deactivated) gets 200 with an empty group list, not a 404 — a miss is not a failure. subject and issuer are always present since they come from the verified token; echoing issuer lets a caller self-diagnose a cross-issuer provisioning gap. responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.MeResponse description: OK '304': description: Not Modified '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error x-required-role: authenticated security: - BearerAuth: [] summary: Get the caller's own directory profile tags: - Me /v1/me/budgets/charges: get: description: >- Lists the charge records derived from the caller's own usage events, scoped to the verified token subject. A page may contain fewer than limit records even when more data exists; keep following next_cursor until it is absent. parameters: - description: Inclusive event_time lower bound, RFC 3339 in: query name: from schema: type: string - description: Exclusive event_time upper bound, RFC 3339 in: query name: to schema: type: string - description: Served model of the underlying event, exact match in: query name: model schema: type: string - description: Opaque keyset cursor from a previous page in: query name: cursor schema: type: string - description: Page size (default 50, max 200, clamped) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ListChargesResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Unauthorized '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List own charges tags: - budgets /v1/me/budgets/events: get: description: >- Lists the caller's own usage events, scoped to the verified token subject. A page may contain fewer than limit records even when more data exists; keep following next_cursor until it is absent. parameters: - description: Inclusive event_time lower bound, RFC 3339 in: query name: from schema: type: string - description: Exclusive event_time upper bound, RFC 3339 in: query name: to schema: type: string - description: Served model, exact match in: query name: model schema: type: string - description: Interaction outcome in: query name: outcome schema: enum: - delivered - blocked_downstream - client_disconnect - upstream_error type: string - description: Opaque keyset cursor from a previous page in: query name: cursor schema: type: string - description: Page size (default 50, max 200, clamped) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ListEventsResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Unauthorized '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List own usage events tags: - budgets /v1/me/budgets/spend: get: parameters: - description: Bucket granularity in: query name: granularity schema: enum: - day type: string - description: Window start, ISO date (default 30 days back, including today) in: query name: from schema: type: string - description: Window end (exclusive), ISO date in: query name: to schema: type: string - description: Served model of the underlying event, exact match in: query name: model schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.SpendSeriesResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Unauthorized '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Own daily spend series tags: - budgets /v1/me/budgets/summary: get: description: >- The caller's personal day/month cards (absent when no personal budget exists at that period) and every budget cell applicable to them. Group rows expose team aggregates, never teammate records; my_contribution_usd is the caller's own share, folded from their charge records (retention-bounded). responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.MeSummaryResponse description: OK '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Unauthorized '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_budgets_v1.ErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Own budgets summary tags: - budgets /v1/me/connections: get: parameters: - description: Narrow to Connections on one gateway install in: query name: gateway_id schema: type: string - description: >- Opaque pagination cursor — pages forward from here (mutually exclusive with before) in: query name: cursor schema: type: string - description: >- Opaque pagination cursor — pages backward from here (mutually exclusive with cursor) in: query name: before schema: type: string - description: Maximum items to return (default 20, max 200) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_ConnectionDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List my connections tags: - Me post: requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.CreateConnectionRequest summary: body description: Connection to create description: Connection to create required: true responses: '201': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectionDTO description: Created '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '403': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Forbidden '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '409': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Conflict '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Create my connection tags: - Me /v1/me/connections/{id}: delete: parameters: - description: Connection UUID in: path name: id required: true schema: type: string responses: '204': description: No Content '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '403': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Forbidden '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete my connection tags: - Me get: parameters: - description: Connection UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectionDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '403': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Forbidden '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get my connection tags: - Me /v1/me/connections/{id}/enabled: put: parameters: - description: Connection UUID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.SetConnectionEnabledRequest summary: body description: New enablement description: New enablement required: true responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectionDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '403': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Forbidden '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Enable or disable my connection tags: - Me /v1/me/connections/{id}/tool-policy: put: parameters: - description: Connection UUID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: oneOf: - type: object - $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.SetConnectionToolPolicyRequest summary: body description: New tool policy description: New tool policy required: true responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectionDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '403': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Forbidden '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '413': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Request Entity Too Large '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Set my connection's tool narrowing tags: - Me /v1/me/gateways/{gateway_id}/connectors: get: parameters: - description: Connector-gateway install id in: path name: gateway_id required: true schema: type: string - description: >- Opaque pagination cursor — pages forward from here (mutually exclusive with before) in: query name: cursor schema: type: string - description: >- Opaque pagination cursor — pages backward from here (mutually exclusive with cursor) in: query name: before schema: type: string - description: Maximum items to return (default 20, max 200) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_ConnectorDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List Connectors visible to me tags: - Me /v1/me/gateways/{gateway_id}/connectors/{id}: get: parameters: - description: Connector-gateway install id in: path name: gateway_id required: true schema: type: string - description: Connector UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.ConnectorDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '401': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Unauthorized '403': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Forbidden '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get a Connector visible to me tags: - Me /v1/me/metering/usage/calls: get: parameters: - description: connector-gateway instance id in: query name: gateway_id required: true schema: type: string - description: Connector id in: query name: connector_id required: true schema: type: string - description: Outcome filter in: query name: outcome schema: enum: - ok - error type: string - description: Decision filter in: query name: decision schema: enum: - allowed - denied type: string - description: 'Window start, RFC 3339 (default: unbounded)' in: query name: start schema: type: string - description: 'Window end, RFC 3339, exclusive (default: unbounded)' in: query name: end schema: type: string - description: Opaque keyset cursor from a previous page, pages forward (older) in: query name: cursor schema: type: string - description: >- Opaque keyset cursor from a previous page, pages backward (newer); mutually exclusive with cursor in: query name: before schema: type: string - description: Page size (default 50, max 500, clamped) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ListCallsResponse description: OK '400': content: application/json: schema: additionalProperties: type: string type: object description: Bad Request '401': content: application/json: schema: additionalProperties: type: string type: object description: Unauthorized '500': content: application/json: schema: additionalProperties: type: string type: object description: Internal Server Error security: - BearerAuth: [] summary: My tool-call activity tags: - metering /v1/metering/usage/connectors/{id}: get: parameters: - description: Connector id in: path name: id required: true schema: type: string - description: connector-gateway instance id in: query name: gateway_id required: true schema: type: string - description: Deployment environment filter in: query name: environment schema: type: string - description: 'Window start, RFC 3339 (default: unbounded)' in: query name: start schema: type: string - description: 'Window end, RFC 3339, exclusive (default: unbounded)' in: query name: end schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ConnectorUsageResponse description: OK '400': content: application/json: schema: additionalProperties: type: string type: object description: Bad Request '500': content: application/json: schema: additionalProperties: type: string type: object description: Internal Server Error security: - BearerAuth: [] summary: Connector usage tags: - metering /v1/metering/usage/connectors/{id}/calls: get: parameters: - description: Connector id in: path name: id required: true schema: type: string - description: connector-gateway instance id in: query name: gateway_id required: true schema: type: string - description: Platform user id (UUID); narrows to one user's calls in: query name: user_id schema: type: string - description: Outcome filter in: query name: outcome schema: enum: - ok - error type: string - description: Decision filter in: query name: decision schema: enum: - allowed - denied type: string - description: 'Window start, RFC 3339 (default: unbounded)' in: query name: start schema: type: string - description: 'Window end, RFC 3339, exclusive (default: unbounded)' in: query name: end schema: type: string - description: Opaque keyset cursor from a previous page, pages forward (older) in: query name: cursor schema: type: string - description: >- Opaque keyset cursor from a previous page, pages backward (newer); mutually exclusive with cursor in: query name: before schema: type: string - description: Page size (default 50, max 500, clamped) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ListCallsResponse description: OK '400': content: application/json: schema: additionalProperties: type: string type: object description: Bad Request '500': content: application/json: schema: additionalProperties: type: string type: object description: Internal Server Error security: - BearerAuth: [] summary: Connector tool-call activity tags: - metering /v1/metering/usage/export: get: parameters: - description: connector-gateway instance id in: query name: gateway_id required: true schema: type: string - description: Deployment environment filter in: query name: environment schema: type: string - description: 'Window start, RFC 3339 (default: unbounded)' in: query name: start schema: type: string - description: 'Window end, RFC 3339, exclusive (default: unbounded)' in: query name: end schema: type: string - description: Opaque keyset cursor from a previous page in: query name: cursor schema: type: string - description: Page size (default 50, max 500, clamped) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.ExportToolCallUsageResponse description: OK '400': content: application/json: schema: additionalProperties: type: string type: object description: Bad Request '500': content: application/json: schema: additionalProperties: type: string type: object description: Internal Server Error security: - BearerAuth: [] summary: Per-event usage export tags: - metering /v1/metering/usage/summary: get: parameters: - description: connector-gateway instance id in: query name: gateway_id required: true schema: type: string - description: Deployment environment filter in: query name: environment schema: type: string - description: 'Window start, RFC 3339 (default: unbounded)' in: query name: start schema: type: string - description: 'Window end, RFC 3339, exclusive (default: unbounded)' in: query name: end schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UsageSummaryResponse description: OK '400': content: application/json: schema: additionalProperties: type: string type: object description: Bad Request '500': content: application/json: schema: additionalProperties: type: string type: object description: Internal Server Error security: - BearerAuth: [] summary: Usage summary tags: - metering /v1/metering/usage/timeseries: get: parameters: - description: connector-gateway instance id in: query name: gateway_id required: true schema: type: string - description: Deployment environment filter in: query name: environment schema: type: string - description: 'Window start, RFC 3339 (default: unbounded)' in: query name: start schema: type: string - description: 'Window end, RFC 3339, exclusive (default: unbounded)' in: query name: end schema: type: string - description: Breakdown dimension in: query name: dimension schema: enum: - environment - tool - decision - connector type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UsageTimeSeriesResponse description: OK '400': content: application/json: schema: additionalProperties: type: string type: object description: Bad Request '500': content: application/json: schema: additionalProperties: type: string type: object description: Internal Server Error security: - BearerAuth: [] summary: Usage time series tags: - metering /v1/metering/usage/top-connectors: get: parameters: - description: connector-gateway instance id in: query name: gateway_id required: true schema: type: string - description: Deployment environment filter in: query name: environment schema: type: string - description: 'Window start, RFC 3339 (default: unbounded)' in: query name: start schema: type: string - description: 'Window end, RFC 3339, exclusive (default: unbounded)' in: query name: end schema: type: string - description: Max entries (default 10, max 100, clamped) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TopConnectorsResponse description: OK '400': content: application/json: schema: additionalProperties: type: string type: object description: Bad Request '500': content: application/json: schema: additionalProperties: type: string type: object description: Internal Server Error security: - BearerAuth: [] summary: Top connectors tags: - metering /v1/metering/usage/top-tools: get: parameters: - description: connector-gateway instance id in: query name: gateway_id required: true schema: type: string - description: Deployment environment filter in: query name: environment schema: type: string - description: 'Window start, RFC 3339 (default: unbounded)' in: query name: start schema: type: string - description: 'Window end, RFC 3339, exclusive (default: unbounded)' in: query name: end schema: type: string - description: Max entries (default 10, max 100, clamped) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.TopToolsResponse description: OK '400': content: application/json: schema: additionalProperties: type: string type: object description: Bad Request '500': content: application/json: schema: additionalProperties: type: string type: object description: Internal Server Error security: - BearerAuth: [] summary: Top tools tags: - metering /v1/metering/usage/users/{id}: get: parameters: - description: Platform user id (UUID) in: path name: id required: true schema: type: string - description: connector-gateway instance id in: query name: gateway_id required: true schema: type: string - description: Deployment environment filter in: query name: environment schema: type: string - description: Window start, RFC 3339 in: query name: start required: true schema: type: string - description: Window end, RFC 3339, exclusive in: query name: end required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_metering_v1.UserUsageResponse description: OK '400': content: application/json: schema: additionalProperties: type: string type: object description: Bad Request '500': content: application/json: schema: additionalProperties: type: string type: object description: Internal Server Error security: - BearerAuth: [] summary: User usage tags: - metering /v1/users: get: parameters: - description: Filter by email address in: query name: email schema: type: string - description: Filter by username in: query name: user_name schema: type: string - description: Filter by provisioning source (e.g. scim) in: query name: source schema: type: string - description: Filter by active status in: query name: active schema: type: boolean - description: >- Case-insensitive substring search across display_name, user_name, and email in: query name: search schema: type: string - description: >- Opaque pagination cursor — pages forward from here (mutually exclusive with before) in: query name: cursor schema: type: string - description: >- Opaque pagination cursor — pages backward from here (mutually exclusive with cursor) in: query name: before schema: type: string - description: Maximum items to return (default 50, max 200) in: query name: limit schema: type: integer responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_UserDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: List users tags: - directory /v1/users/{id}: get: parameters: - description: User UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.UserDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get user tags: - directory /v1/users/{id}/groups: get: parameters: - description: User UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/internal_directory_app.ListResponse-github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1_GroupDTO description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get user groups tags: - directory /v1/users/{id}/metadata: delete: parameters: - description: User UUID in: path name: id required: true schema: type: string responses: '204': description: No Content '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Delete user metadata tags: - directory get: parameters: - description: User UUID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.MetadataResponse description: OK '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '404': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Not Found '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Get user metadata tags: - directory put: parameters: - description: User UUID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: type: object text/plain: schema: title: body type: object description: Metadata JSON document required: true responses: '204': description: No Content '400': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Bad Request '500': content: application/json: schema: $ref: >- #/components/schemas/github_com_stacklok_stacklok-enterprise-platform_enterprise_toolhive-enterprise_contracts_directory_v1.AdminErrorResponse description: Internal Server Error security: - BearerAuth: [] summary: Put user metadata tags: - directory openapi: 3.1.0 servers: - url: http://localhost:8080