{
  "components": {
    "schemas": {
      "AcceptInvitation": {
        "additionalProperties": false,
        "description": "`:accept` body.",
        "properties": {
          "keyset_version": {
            "description": "The keyset version the invitee publishes to the account. The admin compares the member code\nof exactly this version.",
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "keyset_version"
        ],
        "type": "object"
      },
      "Accepted": {
        "description": "`:accept` answer.",
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "account_kind": {
            "type": "string"
          },
          "account_name": {
            "type": "string"
          },
          "inviter": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/Inviter"
              },
              {
                "type": "null"
              }
            ]
          },
          "role": {
            "type": "string"
          },
          "state": {
            "description": "`pending_confirm` until an admin confirms the member code.",
            "type": "string"
          }
        },
        "required": [
          "account_id",
          "account_name",
          "account_kind",
          "role",
          "state"
        ],
        "type": "object"
      },
      "AccountOut": {
        "description": "An organisation account as its members see it.",
        "properties": {
          "created_at": {
            "type": "string"
          },
          "etag": {
            "description": "Sent back in `If-Match` to rename.",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "kind": {
            "description": "`individual`, `family`, `team`, `business` or `enterprise`.",
            "type": "string"
          },
          "member_count": {
            "description": "Members in any state.",
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "open_invitations": {
            "description": "Invitations that are open and not expired.",
            "format": "int64",
            "type": "integer"
          },
          "pending_confirmation": {
            "description": "Members who accepted and wait for an admin to confirm their code.",
            "format": "int64",
            "type": "integer"
          },
          "require_2fa": {
            "description": "The ORG-04 `require_2fa` policy.",
            "type": "boolean"
          },
          "role": {
            "description": "The caller's role.",
            "type": "string"
          },
          "seat_limit": {
            "description": "Most people the account may hold, when the plan sets a limit.",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "slug": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "kind",
          "name",
          "slug",
          "status",
          "role",
          "member_count",
          "pending_confirmation",
          "open_invitations",
          "require_2fa",
          "created_at",
          "etag"
        ],
        "type": "object"
      },
      "AccountSummary": {
        "description": "An account the person belongs to.",
        "properties": {
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "kind": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "role": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "kind",
          "name",
          "role"
        ],
        "type": "object"
      },
      "AnchorView": {
        "description": "The newest checkpoint, the tree head that contains it, and the proof.",
        "properties": {
          "checkpoint": {
            "$ref": "#/components/schemas/CheckpointView"
          },
          "inclusion": {
            "$ref": "#/components/schemas/InclusionView"
          },
          "tree_head": {
            "$ref": "#/components/schemas/TreeHeadView"
          }
        },
        "required": [
          "checkpoint",
          "tree_head",
          "inclusion"
        ],
        "type": "object"
      },
      "Applied": {
        "description": "A mutation the server applied, with the item's version afterwards.",
        "properties": {
          "item_id": {
            "format": "uuid",
            "type": "string"
          },
          "version": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "item_id",
          "version"
        ],
        "type": "object"
      },
      "AttachmentDownload": {
        "description": "What a client needs to download and decrypt a file.",
        "properties": {
          "chunk_count": {
            "format": "int32",
            "type": "integer"
          },
          "chunk_sha256": {
            "description": "SHA-256 of each object (base64url), recorded at `:complete`.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "chunk_size": {
            "format": "int32",
            "type": "integer"
          },
          "ciphertext_size": {
            "format": "int64",
            "type": "integer"
          },
          "download": {
            "items": {
              "$ref": "#/components/schemas/ChunkUrl"
            },
            "type": "array"
          },
          "expires_at": {
            "description": "When the download URLs stop working.",
            "type": "string"
          },
          "file_key_wrapped": {
            "format": "byte",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "item_id": {
            "format": "uuid",
            "type": "string"
          },
          "vault_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "id",
          "item_id",
          "vault_id",
          "chunk_size",
          "chunk_count",
          "ciphertext_size",
          "file_key_wrapped",
          "chunk_sha256",
          "expires_at",
          "download"
        ],
        "type": "object"
      },
      "AttachmentState": {
        "description": "An attachment's state.",
        "properties": {
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "state"
        ],
        "type": "object"
      },
      "AuditEventPage": {
        "description": "A page of events, newest first.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/AuditEventView"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "AuditEventView": {
        "description": "One audit event with the hashes that chain it.",
        "properties": {
          "action": {
            "type": "string"
          },
          "actor": {
            "description": "`user:<id>`, `machine:<id>`, `system:<job>` or `scim`.",
            "type": "string"
          },
          "actor_device": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "actor_name": {
            "description": "Name or email of a person actor, when the account can see them. Not hashed.",
            "type": [
              "string",
              "null"
            ]
          },
          "details": {
            "description": "Ids and enums only.",
            "type": "object"
          },
          "hash": {
            "description": "Head after this event, base64url.",
            "type": "string"
          },
          "ip": {
            "type": [
              "string",
              "null"
            ]
          },
          "occurred_at": {
            "description": "RFC 3339 with six fractional digits. This exact string is hashed.",
            "type": "string"
          },
          "outcome": {
            "description": "`success`, `denied` or `error`.",
            "type": "string"
          },
          "prev_hash": {
            "description": "Head before this event, base64url.",
            "type": "string"
          },
          "seq": {
            "format": "int64",
            "type": "integer"
          },
          "target_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "target_type": {
            "type": "string"
          },
          "user_agent": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "seq",
          "occurred_at",
          "actor",
          "action",
          "target_type",
          "outcome",
          "details",
          "prev_hash",
          "hash"
        ],
        "type": "object"
      },
      "AuditKeyView": {
        "description": "One published key.",
        "properties": {
          "alg": {
            "type": "string"
          },
          "kid": {
            "type": "string"
          },
          "public_key": {
            "description": "Raw Ed25519 public key, base64url.",
            "type": "string"
          },
          "status": {
            "description": "`current` or `retired`.",
            "type": "string"
          }
        },
        "required": [
          "kid",
          "alg",
          "public_key",
          "status"
        ],
        "type": "object"
      },
      "B64": {
        "description": "base64url without padding",
        "format": "byte",
        "type": "string"
      },
      "BatchWrite": {
        "properties": {
          "secrets": {
            "items": {
              "$ref": "#/components/schemas/BatchWriteEntry"
            },
            "type": "array"
          }
        },
        "required": [
          "secrets"
        ],
        "type": "object"
      },
      "BatchWriteEntry": {
        "description": "One upsert in a batch write (dotenv import). A known `lookup_hmac` adds a version to the\nexisting secret. An unknown one creates the secret with `id`.",
        "properties": {
          "folder_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "lookup_hmac": {
            "$ref": "#/components/schemas/B64"
          },
          "meta_ct": {
            "$ref": "#/components/schemas/B64"
          },
          "path": {
            "type": [
              "string",
              "null"
            ]
          },
          "version": {
            "$ref": "#/components/schemas/VersionIn"
          }
        },
        "required": [
          "id",
          "lookup_hmac",
          "meta_ct",
          "version"
        ],
        "type": "object"
      },
      "BatchWriteOutcome": {
        "properties": {
          "created": {
            "type": "boolean"
          },
          "secret_id": {
            "format": "uuid",
            "type": "string"
          },
          "version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "secret_id",
          "version",
          "created"
        ],
        "type": "object"
      },
      "BatchWriteResult": {
        "properties": {
          "environment_revision": {
            "format": "int64",
            "type": "integer"
          },
          "results": {
            "items": {
              "$ref": "#/components/schemas/BatchWriteOutcome"
            },
            "type": "array"
          }
        },
        "required": [
          "environment_revision",
          "results"
        ],
        "type": "object"
      },
      "ChangeRole": {
        "additionalProperties": false,
        "description": "`PATCH /v1/accounts/{id}/members/{user}` body.",
        "properties": {
          "role": {
            "type": "string"
          }
        },
        "required": [
          "role"
        ],
        "type": "object"
      },
      "ChangesPage": {
        "description": "`GET /v1/vaults/{id}/changes` (API.md §5.1).",
        "properties": {
          "from_revision": {
            "format": "int64",
            "type": "integer"
          },
          "has_more": {
            "type": "boolean"
          },
          "items": {
            "items": {
              "$ref": "#/components/schemas/ItemEnvelope"
            },
            "type": "array"
          },
          "to_revision": {
            "format": "int64",
            "type": "integer"
          },
          "tombstones": {
            "items": {
              "$ref": "#/components/schemas/Tombstone"
            },
            "type": "array"
          },
          "vault": {
            "$ref": "#/components/schemas/VaultHead"
          },
          "vault_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "vault_id",
          "from_revision",
          "to_revision",
          "has_more",
          "vault",
          "items",
          "tombstones"
        ],
        "type": "object"
      },
      "CheckoutRequest": {
        "description": "What to buy.",
        "properties": {
          "interval": {
            "description": "`month` or `year`.",
            "type": "string"
          },
          "plan": {
            "description": "`personal`, `family`, `team` or `business`.",
            "type": "string"
          }
        },
        "required": [
          "plan",
          "interval"
        ],
        "type": "object"
      },
      "CheckpointList": {
        "description": "Checkpoints newest first, with the keys that verify them.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/CheckpointView"
            },
            "type": "array"
          },
          "keys": {
            "description": "Every key that signed a checkpoint. Clients that pin the published key set compare it.",
            "items": {
              "$ref": "#/components/schemas/AuditKeyView"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          },
          "tree_head": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/TreeHeadView",
                "description": "The newest signed tree head."
              },
              {
                "type": "null"
              }
            ]
          }
        },
        "required": [
          "keys",
          "data"
        ],
        "type": "object"
      },
      "CheckpointView": {
        "description": "A signed checkpoint of the account's chain.",
        "properties": {
          "head": {
            "description": "Chain head at `seq`, base64url.",
            "type": "string"
          },
          "key_id": {
            "type": "string"
          },
          "seq": {
            "format": "int64",
            "type": "integer"
          },
          "signature": {
            "description": "Ed25519 signature, base64url.",
            "type": "string"
          },
          "signed_at": {
            "type": "string"
          },
          "signed_at_ms": {
            "description": "Part of the signed message.",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "seq",
          "head",
          "signed_at_ms",
          "signed_at",
          "key_id",
          "signature"
        ],
        "type": "object"
      },
      "ChunkUrl": {
        "description": "One presigned URL.",
        "properties": {
          "index": {
            "format": "int32",
            "type": "integer"
          },
          "method": {
            "type": "string"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "index",
          "method",
          "url"
        ],
        "type": "object"
      },
      "CompleteAttachment": {
        "description": "`POST /v1/attachments/{id}:complete` body.",
        "properties": {
          "chunk_sha256": {
            "description": "SHA-256 of each uploaded object, in chunk order (base64url).",
            "items": {
              "type": "string"
            },
            "type": "array"
          }
        },
        "required": [
          "chunk_sha256"
        ],
        "type": "object"
      },
      "ConfirmMember": {
        "additionalProperties": false,
        "description": "`:confirm` body.",
        "properties": {
          "groups": {
            "items": {
              "$ref": "#/components/schemas/GroupGrantIn"
            },
            "type": "array"
          },
          "keyset_version": {
            "description": "The keyset version whose member code the admin compared.",
            "format": "int32",
            "type": "integer"
          },
          "vaults": {
            "items": {
              "$ref": "#/components/schemas/VaultGrantIn"
            },
            "type": "array"
          }
        },
        "required": [
          "keyset_version"
        ],
        "type": "object"
      },
      "Conflict": {
        "description": "A rejected mutation and the server's current copy. `server` is `None` when the item was\npermanently deleted, and `deleted` is then true.",
        "properties": {
          "deleted": {
            "type": "boolean"
          },
          "item_id": {
            "format": "uuid",
            "type": "string"
          },
          "server": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/ItemEnvelope"
              },
              {
                "type": "null"
              }
            ]
          }
        },
        "required": [
          "item_id"
        ],
        "type": "object"
      },
      "CreateAccount": {
        "additionalProperties": false,
        "description": "`POST /v1/accounts` body.",
        "properties": {
          "kind": {
            "description": "`family` or `team`.",
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "kind",
          "name"
        ],
        "type": "object"
      },
      "CreateEnvironment": {
        "description": "A new environment. In Zero-knowledge projects the creator's client generates the environment\nkey and sends at least one grant, usually to itself, because the server never sees the key.",
        "properties": {
          "grants": {
            "items": {
              "$ref": "#/components/schemas/KeyGrantIn"
            },
            "type": "array"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "slug",
          "name"
        ],
        "type": "object"
      },
      "CreateFolder": {
        "properties": {
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "lookup_hmac": {
            "$ref": "#/components/schemas/B64"
          },
          "name_ct": {
            "$ref": "#/components/schemas/B64"
          },
          "parent_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "path": {
            "description": "Managed projects only.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "lookup_hmac",
          "name_ct"
        ],
        "type": "object"
      },
      "CreateGroup": {
        "additionalProperties": false,
        "description": "`POST /v1/accounts/{id}/groups` body.",
        "properties": {
          "enc_public_key": {
            "description": "The new group's X-Wing public key.",
            "format": "byte",
            "type": "string"
          },
          "id": {
            "description": "A UUIDv7 the client chose, so it can seal the first grants before the group exists. The\nserver picks one when it is absent.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "members": {
            "description": "First members, usually the creator. Each must be an active member of the account.",
            "items": {
              "$ref": "#/components/schemas/GroupKeyGrant"
            },
            "type": "array"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "enc_public_key"
        ],
        "type": "object"
      },
      "CreateIdentity": {
        "properties": {
          "description": {
            "type": [
              "string",
              "null"
            ]
          },
          "enc_public_key": {
            "$ref": "#/components/schemas/B64",
            "description": "The identity's X-Wing public key. Environment keys are sealed to it."
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "enc_public_key"
        ],
        "type": "object"
      },
      "CreateInvitation": {
        "additionalProperties": false,
        "description": "`POST /v1/accounts/{id}/invitations` body.",
        "properties": {
          "email": {
            "type": "string"
          },
          "role": {
            "type": "string"
          }
        },
        "required": [
          "email",
          "role"
        ],
        "type": "object"
      },
      "CreateProject": {
        "properties": {
          "encryption_mode": {
            "$ref": "#/components/schemas/EncryptionMode"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "slug",
          "name",
          "encryption_mode"
        ],
        "type": "object"
      },
      "CreateRoleBinding": {
        "properties": {
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "principal_id": {
            "format": "uuid",
            "type": "string"
          },
          "principal_type": {
            "$ref": "#/components/schemas/PrincipalType"
          },
          "role": {
            "description": "A built-in role key (`viewer`, `secret_reader`, `secret_writer`, `admin`) or a role id.",
            "type": "string"
          },
          "scope_id": {
            "format": "uuid",
            "type": "string"
          },
          "scope_type": {
            "type": "string"
          }
        },
        "required": [
          "role",
          "principal_type",
          "principal_id",
          "scope_type",
          "scope_id"
        ],
        "type": "object"
      },
      "CreateSecret": {
        "properties": {
          "folder_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "lookup_hmac": {
            "$ref": "#/components/schemas/B64"
          },
          "meta_ct": {
            "$ref": "#/components/schemas/B64"
          },
          "path": {
            "description": "Managed projects only.",
            "type": [
              "string",
              "null"
            ]
          },
          "version": {
            "$ref": "#/components/schemas/VersionIn"
          }
        },
        "required": [
          "id",
          "lookup_hmac",
          "meta_ct",
          "version"
        ],
        "type": "object"
      },
      "CreateShareLink": {
        "description": "`POST /v1/share-links` body.",
        "properties": {
          "auth_hash": {
            "description": "SHA-256 of the access token, 32 bytes.",
            "format": "byte",
            "type": "string"
          },
          "expires_in_seconds": {
            "description": "Seconds until the link stops working, from 60 to 30 days.",
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "description": "Chosen by the client, because the snapshot's encryption context includes it.",
            "format": "uuid",
            "type": "string"
          },
          "item_id": {
            "format": "uuid",
            "type": "string"
          },
          "max_views": {
            "description": "Views allowed, from 1 to 100. `None` allows any number until expiry.",
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "passphrase_salt": {
            "description": "The Argon2id salt, 16 bytes, when the link has a passphrase.",
            "format": "byte",
            "type": [
              "string",
              "null"
            ]
          },
          "snapshot_ct": {
            "description": "The item snapshot encrypted under the link key.",
            "format": "byte",
            "type": "string"
          },
          "vault_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "id",
          "vault_id",
          "item_id",
          "snapshot_ct",
          "auth_hash",
          "expires_in_seconds"
        ],
        "type": "object"
      },
      "CreateVault": {
        "description": "`POST /v1/vaults` body (API.md §3.1.1).",
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "attrs_ct": {
            "format": "byte",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "kind": {
            "type": "string"
          },
          "vault_key_wrapped": {
            "format": "byte",
            "type": "string"
          }
        },
        "required": [
          "id",
          "account_id",
          "kind",
          "attrs_ct",
          "key_version",
          "vault_key_wrapped"
        ],
        "type": "object"
      },
      "CreateWebhook": {
        "properties": {
          "description": {
            "type": [
              "string",
              "null"
            ]
          },
          "event_types": {
            "description": "Event types from API.md §4.13.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "project_id": {
            "description": "Limit the webhook to one project. Default: every project in the account.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "url",
          "event_types"
        ],
        "type": "object"
      },
      "CreatedVersion": {
        "properties": {
          "environment_revision": {
            "format": "int64",
            "type": "integer"
          },
          "secret_id": {
            "format": "uuid",
            "type": "string"
          },
          "version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "secret_id",
          "version",
          "environment_revision"
        ],
        "type": "object"
      },
      "CreatedWebhook": {
        "description": "A new webhook with its signing secret. The secret is shown once.",
        "properties": {
          "signing_secret": {
            "description": "`whsec_<base64url>`. Receivers check `Sphragis-Signature` with it.",
            "type": "string"
          },
          "webhook": {
            "$ref": "#/components/schemas/Webhook"
          }
        },
        "required": [
          "webhook",
          "signing_secret"
        ],
        "type": "object"
      },
      "DeclareAttachment": {
        "description": "`POST /v1/vaults/{id}/attachments` body.",
        "properties": {
          "chunk_count": {
            "format": "int32",
            "type": "integer"
          },
          "chunk_size": {
            "description": "Plaintext bytes per chunk. Must be 1048576.",
            "format": "int32",
            "type": "integer"
          },
          "ciphertext_size": {
            "description": "Sum of every object's size: header, ciphertext and tags.",
            "format": "int64",
            "type": "integer"
          },
          "file_key_wrapped": {
            "description": "The file key wrapped by the item key (base64url).",
            "format": "byte",
            "type": "string"
          },
          "id": {
            "description": "Client-chosen UUIDv7. It is bound into the STREAM nonce context, so it exists before upload.",
            "format": "uuid",
            "type": "string"
          },
          "item_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "id",
          "item_id",
          "chunk_size",
          "chunk_count",
          "ciphertext_size",
          "file_key_wrapped"
        ],
        "type": "object"
      },
      "DeclaredAttachment": {
        "description": "Answer to a declaration.",
        "properties": {
          "chunk_count": {
            "format": "int32",
            "type": "integer"
          },
          "expires_at": {
            "description": "When the upload URLs stop working.",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "state": {
            "type": "string"
          },
          "upload": {
            "items": {
              "$ref": "#/components/schemas/ChunkUrl"
            },
            "type": "array"
          }
        },
        "required": [
          "id",
          "state",
          "chunk_count",
          "expires_at",
          "upload"
        ],
        "type": "object"
      },
      "DestroyVersion": {
        "properties": {
          "after_hours": {
            "description": "Hours before the value is erased. Zero erases now. Defaults to 24.",
            "format": "int32",
            "minimum": 0,
            "type": [
              "integer",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "DeviceChallenge": {
        "description": "`POST /v1/unlock/device/challenge` response.",
        "properties": {
          "challenge": {
            "description": "32 random bytes, base64url.",
            "type": "string"
          },
          "expires_in": {
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "challenge",
          "expires_in"
        ],
        "type": "object"
      },
      "DeviceChallengeRequest": {
        "additionalProperties": false,
        "description": "`POST /v1/unlock/device/challenge` body.",
        "properties": {
          "device_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "device_id"
        ],
        "type": "object"
      },
      "DeviceCodeRequest": {
        "description": "`POST /v1/sib/device/lookup`, `/approve` and `/deny`: the CLI sign-in code the person typed.",
        "properties": {
          "user_code": {
            "description": "The code the CLI shows, for example `BCDF-GHJK`.",
            "type": "string"
          }
        },
        "required": [
          "user_code"
        ],
        "type": "object"
      },
      "DeviceCodeResponse": {
        "description": "SBI's answer about a CLI sign-in code. `lookup` sets `client_id`, `client_name` and `scope`.\n`approve` sets `status` `approved`, `client_name` and `scope`. `deny` sets `status` `denied`.",
        "properties": {
          "client_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "client_name": {
            "type": [
              "string",
              "null"
            ]
          },
          "scope": {
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "DeviceInput": {
        "additionalProperties": false,
        "description": "The `device` object of API.md §3.1.1.",
        "properties": {
          "client_version": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "platform": {
            "type": "string"
          },
          "proof_public_jwk": {
            "$ref": "#/components/schemas/PublicJwk"
          }
        },
        "required": [
          "id",
          "name",
          "platform",
          "client_version",
          "proof_public_jwk"
        ],
        "type": "object"
      },
      "DeviceList": {
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/DeviceView"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "DeviceUnlock": {
        "additionalProperties": false,
        "description": "`POST /v1/unlock/device` body.",
        "properties": {
          "challenge": {
            "type": "string"
          },
          "device_id": {
            "format": "uuid",
            "type": "string"
          },
          "signature": {
            "description": "ES256 signature, raw `r || s`, over\n`\"sphragis/v1/device-unlock\" || challenge || user_id || device_id`.",
            "type": "string"
          }
        },
        "required": [
          "device_id",
          "challenge",
          "signature"
        ],
        "type": "object"
      },
      "DeviceUnlocked": {
        "allOf": [
          {
            "$ref": "#/components/schemas/Unlocked"
          },
          {
            "properties": {
              "full_unlock_due_at": {
                "description": "When this device must next unlock with the master password.",
                "format": "date-time",
                "type": "string"
              }
            },
            "required": [
              "full_unlock_due_at"
            ],
            "type": "object"
          }
        ],
        "description": "`POST /v1/unlock/device` response."
      },
      "DeviceView": {
        "description": "A device as the device list shows it.",
        "properties": {
          "client_version": {
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "current": {
            "description": "True for the device that made this request.",
            "type": "boolean"
          },
          "etag": {
            "description": "Send this back in `If-Match` to rename the device.",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_seen_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "name": {
            "type": "string"
          },
          "platform": {
            "type": "string"
          },
          "trusted": {
            "type": "boolean"
          }
        },
        "required": [
          "id",
          "name",
          "platform",
          "client_version",
          "trusted",
          "created_at",
          "current",
          "etag"
        ],
        "type": "object"
      },
      "EncryptionMode": {
        "description": "`zk` or `managed` (SEC-05).",
        "enum": [
          "zk",
          "managed"
        ],
        "type": "string"
      },
      "Environment": {
        "properties": {
          "encryption_mode": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/EncryptionMode",
                "description": "The project's mode, so clients know whether to expect sealed values."
              },
              {
                "type": "null"
              }
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "position": {
            "format": "int32",
            "type": "integer"
          },
          "project_id": {
            "format": "uuid",
            "type": "string"
          },
          "protected": {
            "type": "boolean"
          },
          "revision": {
            "format": "int64",
            "type": "integer"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "project_id",
          "slug",
          "name",
          "protected",
          "revision",
          "key_version",
          "position"
        ],
        "type": "object"
      },
      "EscrowEntry": {
        "description": "`GET /v1/secrets/identities/{id}/escrow/me`: the caller's sealed copy of the seed.",
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "escrow_version": {
            "format": "int32",
            "type": "integer"
          },
          "identity_id": {
            "format": "uuid",
            "type": "string"
          },
          "recipient_id": {
            "format": "uuid",
            "type": "string"
          },
          "sealed_by": {
            "format": "uuid",
            "type": "string"
          },
          "sealer_sign_public_key": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/B64",
                "description": "The sealer's current Ed25519 key, which the reader checks the signature against."
              },
              {
                "type": "null"
              }
            ]
          },
          "seed_sealed": {
            "$ref": "#/components/schemas/B64",
            "description": "Sealed box `0x11` with context `identity-seed/1`."
          }
        },
        "required": [
          "identity_id",
          "recipient_id",
          "escrow_version",
          "seed_sealed",
          "sealed_by",
          "created_at"
        ],
        "type": "object"
      },
      "EscrowGrantRef": {
        "description": "One environment key version the identity holds.",
        "properties": {
          "environment_id": {
            "format": "uuid",
            "type": "string"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "project_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "environment_id",
          "project_id",
          "key_version"
        ],
        "type": "object"
      },
      "EscrowHolder": {
        "description": "A person who may hold, or holds, a copy of the seed.",
        "properties": {
          "eligible": {
            "description": "True when the person meets the holder rule now.",
            "type": "boolean"
          },
          "escrowed": {
            "description": "True when the person has a copy at the current escrow version.",
            "type": "boolean"
          },
          "grants": {
            "description": "The person's grants for the environment key versions the identity holds.",
            "items": {
              "$ref": "#/components/schemas/HolderGrant"
            },
            "type": "array"
          },
          "public_keys": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/HolderKeys"
              },
              {
                "type": "null"
              }
            ]
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "eligible",
          "escrowed"
        ],
        "type": "object"
      },
      "EscrowStatus": {
        "description": "`GET /v1/secrets/identities/{id}/escrow`: who holds the seed and who may.",
        "properties": {
          "escrow_version": {
            "format": "int32",
            "type": "integer"
          },
          "holders": {
            "items": {
              "$ref": "#/components/schemas/EscrowHolder"
            },
            "type": "array"
          },
          "identity_grants": {
            "items": {
              "$ref": "#/components/schemas/EscrowGrantRef"
            },
            "type": "array"
          },
          "identity_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "identity_id",
          "escrow_version",
          "identity_grants",
          "holders"
        ],
        "type": "object"
      },
      "Folder": {
        "properties": {
          "environment_id": {
            "format": "uuid",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "lookup_hmac": {
            "$ref": "#/components/schemas/B64"
          },
          "name_ct": {
            "$ref": "#/components/schemas/B64"
          },
          "parent_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "path": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "environment_id",
          "lookup_hmac",
          "name_ct"
        ],
        "type": "object"
      },
      "ForgotPasswordRequest": {
        "description": "`POST /v1/sib/forgot-password`.",
        "properties": {
          "client_id": {
            "type": "string"
          },
          "email": {
            "type": "string"
          }
        },
        "required": [
          "client_id",
          "email"
        ],
        "type": "object"
      },
      "Grant": {
        "description": "One grant on a vault.",
        "properties": {
          "granted_by": {
            "format": "uuid",
            "type": "string"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "permissions": {
            "format": "int32",
            "type": "integer"
          },
          "principal_id": {
            "format": "uuid",
            "type": "string"
          },
          "principal_type": {
            "type": "string"
          }
        },
        "required": [
          "principal_type",
          "principal_id",
          "permissions",
          "key_version",
          "granted_by"
        ],
        "type": "object"
      },
      "GrantList": {
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/Grant"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "Group": {
        "description": "A group.",
        "properties": {
          "created_at": {
            "type": "string"
          },
          "enc_public_key": {
            "description": "X-Wing public key, base64url.",
            "type": "string"
          },
          "etag": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "kind": {
            "description": "`owners`, `admins`, `recovery` or `custom`.",
            "type": "string"
          },
          "member_count": {
            "format": "int64",
            "type": "integer"
          },
          "my_key": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/MyGroupKey",
                "description": "Present when the caller is in the group."
              },
              {
                "type": "null"
              }
            ]
          },
          "name": {
            "type": "string"
          },
          "rotation_required": {
            "description": "Someone who held the key left. An admin should rotate it.",
            "type": "boolean"
          }
        },
        "required": [
          "id",
          "name",
          "kind",
          "enc_public_key",
          "key_version",
          "member_count",
          "rotation_required",
          "created_at",
          "etag"
        ],
        "type": "object"
      },
      "GroupDetail": {
        "allOf": [
          {
            "$ref": "#/components/schemas/Group"
          },
          {
            "properties": {
              "members": {
                "items": {
                  "$ref": "#/components/schemas/GroupMemberOut"
                },
                "type": "array"
              },
              "vault_grants": {
                "description": "The group's sealed vault keys. Present only for members of the group, who hold the key\nthat opens them. A rotation re-seals each one to the new group key.",
                "items": {
                  "$ref": "#/components/schemas/GroupVaultGrantOut"
                },
                "type": "array"
              },
              "vaults": {
                "description": "Vaults granted to the group.",
                "items": {
                  "format": "uuid",
                  "type": "string"
                },
                "type": "array"
              }
            },
            "required": [
              "members",
              "vaults",
              "vault_grants"
            ],
            "type": "object"
          }
        ],
        "description": "A group with its members."
      },
      "GroupGrantIn": {
        "additionalProperties": false,
        "description": "A group grant sealed to a member at confirmation.",
        "properties": {
          "group_id": {
            "format": "uuid",
            "type": "string"
          },
          "group_key_wrapped": {
            "description": "The group private key sealed (`0x11`) to the member's keyset `enc` key.",
            "format": "byte",
            "type": "string"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "group_id",
          "key_version",
          "group_key_wrapped"
        ],
        "type": "object"
      },
      "GroupKeyGrant": {
        "additionalProperties": false,
        "description": "A member's sealed copy of a group key.",
        "properties": {
          "group_key_wrapped": {
            "description": "The group private key sealed (`0x11`) to the member's keyset `enc` key.",
            "format": "byte",
            "type": "string"
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "group_key_wrapped"
        ],
        "type": "object"
      },
      "GroupList": {
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/Group"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "GroupMemberOut": {
        "description": "One person in a group.",
        "properties": {
          "added_at": {
            "type": "string"
          },
          "granted_by": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "key_version",
          "added_at"
        ],
        "type": "object"
      },
      "GroupMemberRemoved": {
        "description": "What a group removal leaves to rotate.",
        "properties": {
          "rekey_vaults": {
            "description": "Vaults granted to the group, which the removed person could open. Rekey each.",
            "items": {
              "format": "uuid",
              "type": "string"
            },
            "type": "array"
          },
          "rotate_group": {
            "description": "Always true: the removed person held the group key.",
            "type": "boolean"
          }
        },
        "required": [
          "rotate_group",
          "rekey_vaults"
        ],
        "type": "object"
      },
      "GroupVaultGrant": {
        "additionalProperties": false,
        "description": "A vault key re-sealed to a rotated group key.",
        "properties": {
          "key_version": {
            "description": "The vault's current key version.",
            "format": "int32",
            "type": "integer"
          },
          "vault_id": {
            "format": "uuid",
            "type": "string"
          },
          "vault_key_wrapped": {
            "description": "The vault key sealed (`0x11`) to the new group public key.",
            "format": "byte",
            "type": "string"
          }
        },
        "required": [
          "vault_id",
          "key_version",
          "vault_key_wrapped"
        ],
        "type": "object"
      },
      "GroupVaultGrantOut": {
        "description": "A vault key sealed to the group.",
        "properties": {
          "granted_by": {
            "format": "uuid",
            "type": "string"
          },
          "granter_sign_public_key": {
            "description": "The granter's current Ed25519 public key, base64url.",
            "type": [
              "string",
              "null"
            ]
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "permissions": {
            "format": "int32",
            "type": "integer"
          },
          "vault_id": {
            "format": "uuid",
            "type": "string"
          },
          "vault_key_wrapped": {
            "description": "The vault key sealed (`0x11`) to the group public key, base64url.",
            "type": "string"
          }
        },
        "required": [
          "vault_id",
          "key_version",
          "permissions",
          "vault_key_wrapped",
          "granted_by"
        ],
        "type": "object"
      },
      "Health": {
        "properties": {
          "status": {
            "type": "string"
          }
        },
        "required": [
          "status"
        ],
        "type": "object"
      },
      "HolderGrant": {
        "description": "One of a candidate holder's own environment key grants, with its signer's key.",
        "properties": {
          "env_key_wrapped": {
            "$ref": "#/components/schemas/B64"
          },
          "environment_id": {
            "format": "uuid",
            "type": "string"
          },
          "granter_sign_public_key": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/B64"
              },
              {
                "type": "null"
              }
            ]
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "environment_id",
          "key_version",
          "env_key_wrapped"
        ],
        "type": "object"
      },
      "HolderKeys": {
        "description": "A candidate holder's signed public bundle, as `GET /v1/accounts/{a}/members` serves it.",
        "properties": {
          "bundle_sig": {
            "$ref": "#/components/schemas/B64"
          },
          "keyset_version": {
            "format": "int32",
            "type": "integer"
          },
          "public_bundle": {
            "type": "object"
          }
        },
        "required": [
          "keyset_version",
          "public_bundle",
          "bundle_sig"
        ],
        "type": "object"
      },
      "Identity": {
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "description": {
            "type": [
              "string",
              "null"
            ]
          },
          "disabled_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "enc_public_key": {
            "$ref": "#/components/schemas/B64"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "account_id",
          "name",
          "enc_public_key",
          "created_at"
        ],
        "type": "object"
      },
      "InclusionView": {
        "description": "RFC 6962 audit path for the account's leaf.",
        "properties": {
          "audit_path": {
            "description": "Sibling hashes from the leaf upwards, base64url.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "leaf_index": {
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "leaf_index",
          "audit_path"
        ],
        "type": "object"
      },
      "Invitation": {
        "description": "An open invitation.",
        "properties": {
          "created_at": {
            "type": "string"
          },
          "email": {
            "type": "string"
          },
          "expired": {
            "type": "boolean"
          },
          "expires_at": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "invited_by": {
            "format": "uuid",
            "type": "string"
          },
          "role": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "email",
          "role",
          "invited_by",
          "created_at",
          "expires_at",
          "expired"
        ],
        "type": "object"
      },
      "InvitationCreated": {
        "allOf": [
          {
            "$ref": "#/components/schemas/Invitation"
          },
          {
            "properties": {
              "token": {
                "description": "Goes in the invitation link. The server keeps only its hash.",
                "type": "string"
              }
            },
            "required": [
              "token"
            ],
            "type": "object"
          }
        ],
        "description": "A new invitation and its token. The token appears only in this answer."
      },
      "InvitationList": {
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/Invitation"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "Inviter": {
        "description": "The person who sent an invitation, with their bundle so the invitee can check their code.",
        "properties": {
          "display_name": {
            "type": [
              "string",
              "null"
            ]
          },
          "email": {
            "type": "string"
          },
          "public_keys": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/MemberKeys"
              },
              {
                "type": "null"
              }
            ]
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "email"
        ],
        "type": "object"
      },
      "IssueToken": {
        "description": "A token issued by the admin's client. The server receives only the verifier and the wrapped\nidentity seed. The token string itself is shown once on the client.",
        "properties": {
          "allowed_cidrs": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "auth_hash": {
            "$ref": "#/components/schemas/B64"
          },
          "display_prefix": {
            "type": "string"
          },
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "identity_key_wrapped": {
            "$ref": "#/components/schemas/B64"
          },
          "name": {
            "type": "string"
          },
          "token_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "token_id",
          "name",
          "display_prefix",
          "auth_hash",
          "identity_key_wrapped"
        ],
        "type": "object"
      },
      "ItemEnvelope": {
        "description": "One item as the server stores it.",
        "properties": {
          "details_ct": {
            "format": "byte",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "item_key_wrapped": {
            "format": "byte",
            "type": "string"
          },
          "overview_ct": {
            "format": "byte",
            "type": "string"
          },
          "revision": {
            "format": "int64",
            "type": "integer"
          },
          "schema_version": {
            "format": "int32",
            "type": "integer"
          },
          "state": {
            "$ref": "#/components/schemas/ItemState"
          },
          "updated_at": {
            "type": [
              "string",
              "null"
            ]
          },
          "updated_by": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "vault_key_version": {
            "format": "int32",
            "type": "integer"
          },
          "version": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "revision",
          "version",
          "schema_version",
          "overview_ct",
          "details_ct",
          "item_key_wrapped",
          "vault_key_version"
        ],
        "type": "object"
      },
      "ItemState": {
        "description": "Server-side item state. Trash is reversible. Delete leaves a tombstone instead.",
        "enum": [
          "active",
          "trashed"
        ],
        "type": "string"
      },
      "KdfParams": {
        "additionalProperties": false,
        "description": "Argon2id parameters and salt as the API carries them. `m` is KiB.",
        "properties": {
          "alg": {
            "type": "string"
          },
          "m": {
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "p": {
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "salt": {
            "type": "string"
          },
          "t": {
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "alg",
          "m",
          "t",
          "p",
          "salt"
        ],
        "type": "object"
      },
      "KeyGrant": {
        "description": "A stored grant, with the granter's public signing key so the reader can check the signature.",
        "properties": {
          "env_key_wrapped": {
            "$ref": "#/components/schemas/B64"
          },
          "environment_id": {
            "format": "uuid",
            "type": "string"
          },
          "granted_by": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "granter_sign_public_key": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/B64"
              },
              {
                "type": "null"
              }
            ]
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "principal_id": {
            "format": "uuid",
            "type": "string"
          },
          "principal_type": {
            "$ref": "#/components/schemas/PrincipalType"
          },
          "project_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "environment_id",
          "project_id",
          "principal_type",
          "principal_id",
          "key_version",
          "env_key_wrapped"
        ],
        "type": "object"
      },
      "KeyGrantIn": {
        "description": "An environment key sealed to one principal and signed by the granter.",
        "properties": {
          "env_key_wrapped": {
            "$ref": "#/components/schemas/B64"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "principal_id": {
            "format": "uuid",
            "type": "string"
          },
          "principal_type": {
            "$ref": "#/components/schemas/PrincipalType"
          }
        },
        "required": [
          "principal_type",
          "principal_id",
          "key_version",
          "env_key_wrapped"
        ],
        "type": "object"
      },
      "KeysetDocument": {
        "additionalProperties": false,
        "description": "The keyset a client uploads at registration and receives at unlock.",
        "properties": {
          "bundle_sig": {
            "type": "string"
          },
          "envelope": {
            "description": "The keyset CBOR encrypted under the AUK (CRYPTOGRAPHY.md §5).",
            "type": "string"
          },
          "public_bundle": {
            "type": "object"
          },
          "version": {
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "version",
          "envelope",
          "public_bundle",
          "bundle_sig"
        ],
        "type": "object"
      },
      "LoginProof": {
        "additionalProperties": false,
        "description": "A fresh OPAQUE login against the current record, which proves the current master password\nand Secret Key (CRYPTOGRAPHY.md §9.3). The client starts it with `/v1/unlock/start`.",
        "properties": {
          "ke3": {
            "type": "string"
          },
          "login_id": {
            "type": "string"
          }
        },
        "required": [
          "login_id",
          "ke3"
        ],
        "type": "object"
      },
      "LoginRequest": {
        "description": "`POST /v1/sib/login`.",
        "properties": {
          "client_id": {
            "type": "string"
          },
          "email": {
            "type": "string"
          },
          "password": {
            "type": "string"
          }
        },
        "required": [
          "client_id",
          "email",
          "password"
        ],
        "type": "object"
      },
      "Me": {
        "properties": {
          "accounts": {
            "items": {
              "$ref": "#/components/schemas/AccountSummary"
            },
            "type": "array"
          },
          "display_name": {
            "type": [
              "string",
              "null"
            ]
          },
          "email": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "locale": {
            "type": "string"
          },
          "new_user": {
            "description": "True on the request that created the user.",
            "type": "boolean"
          }
        },
        "required": [
          "id",
          "email",
          "locale",
          "accounts",
          "new_user"
        ],
        "type": "object"
      },
      "Member": {
        "description": "One member of an account.",
        "properties": {
          "accepted_at": {
            "type": [
              "string",
              "null"
            ]
          },
          "confirmed_at": {
            "type": [
              "string",
              "null"
            ]
          },
          "created_at": {
            "type": "string"
          },
          "display_name": {
            "type": [
              "string",
              "null"
            ]
          },
          "email": {
            "type": "string"
          },
          "etag": {
            "description": "Sent back in `If-Match` to change the role.",
            "type": "string"
          },
          "groups": {
            "items": {
              "$ref": "#/components/schemas/MemberGroup"
            },
            "type": "array"
          },
          "keyset_version": {
            "description": "The keyset version the member published when they accepted.",
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "mfa_methods": {
            "description": "SIB `amr` values from the member's last fresh sign-in seen by this account.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "mfa_seen_at": {
            "type": [
              "string",
              "null"
            ]
          },
          "public_keys": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/MemberKeys",
                "description": "Present with `?include=keys`."
              },
              {
                "type": "null"
              }
            ]
          },
          "role": {
            "type": "string"
          },
          "state": {
            "description": "`invited`, `pending_confirm`, `active` or `suspended`.",
            "type": "string"
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "email",
          "role",
          "state",
          "groups",
          "mfa_methods",
          "created_at",
          "etag"
        ],
        "type": "object"
      },
      "MemberActionOut": {
        "description": "Member lifecycle answers.",
        "oneOf": [
          {
            "$ref": "#/components/schemas/Member"
          },
          {
            "$ref": "#/components/schemas/Removed"
          }
        ]
      },
      "MemberGroup": {
        "description": "A group a member belongs to.",
        "properties": {
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name"
        ],
        "type": "object"
      },
      "MemberKeys": {
        "description": "A member's signed public bundle, for the member code and for sealing keys to them.",
        "properties": {
          "bundle_sig": {
            "description": "Ed25519 self-signature over `JCS(public_bundle)`, base64url.",
            "type": "string"
          },
          "keyset_version": {
            "format": "int32",
            "type": "integer"
          },
          "public_bundle": {
            "description": "The bundle exactly as the member signed it (CRYPTOGRAPHY.md §5).",
            "type": "object"
          }
        },
        "required": [
          "keyset_version",
          "public_bundle",
          "bundle_sig"
        ],
        "type": "object"
      },
      "MemberList": {
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/Member"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "MfaRequest": {
        "description": "`POST /v1/sib/mfa`.",
        "properties": {
          "client_id": {
            "type": "string"
          },
          "code": {
            "description": "A six-digit authenticator code or a recovery code.",
            "type": "string"
          },
          "mfa_token": {
            "type": "string"
          }
        },
        "required": [
          "client_id",
          "mfa_token",
          "code"
        ],
        "type": "object"
      },
      "MoveAttachment": {
        "description": "One file that moves with its item.",
        "properties": {
          "file_key_wrapped": {
            "description": "The file key wrapped by the new item key, with the new vault and item in its context.",
            "format": "byte",
            "type": "string"
          },
          "id": {
            "description": "The attachment id. It does not change, because the chunk AAD binds it.",
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "id",
          "file_key_wrapped"
        ],
        "type": "object"
      },
      "MoveConflict": {
        "description": "The `409 sync.conflict` answer of a move: nothing applied, and the server copy of each item\nwhose `base_version` was stale.",
        "properties": {
          "conflicts": {
            "items": {
              "$ref": "#/components/schemas/Conflict"
            },
            "type": "array"
          }
        },
        "required": [
          "conflicts"
        ],
        "type": "object"
      },
      "MoveItem": {
        "description": "One item to move, already sealed for the target vault.",
        "properties": {
          "attachments": {
            "description": "The item's files, each key re-wrapped for the new item (CRYPTOGRAPHY.md §6.4). A move must\nlist every ready file of the item. The stored chunks stay as they are.",
            "items": {
              "$ref": "#/components/schemas/MoveAttachment"
            },
            "type": "array"
          },
          "base_version": {
            "description": "The source item's current version. A stale version rejects the whole request.",
            "format": "int64",
            "type": "integer"
          },
          "details_ct": {
            "description": "Details sealed for the target vault with `rev` 1.",
            "format": "byte",
            "type": "string"
          },
          "item_id": {
            "description": "The item in the source vault.",
            "format": "uuid",
            "type": "string"
          },
          "item_key_wrapped": {
            "description": "A fresh item key wrapped under the target vault key.",
            "format": "byte",
            "type": "string"
          },
          "new_item_id": {
            "description": "The id of the new item in the target vault. The client picks it (UUIDv7).",
            "format": "uuid",
            "type": "string"
          },
          "overview_ct": {
            "description": "Overview sealed for the target vault with `rev` 1.",
            "format": "byte",
            "type": "string"
          },
          "schema_version": {
            "format": "int32",
            "type": "integer"
          },
          "vault_key_version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "item_id",
          "base_version",
          "new_item_id",
          "overview_ct",
          "details_ct",
          "item_key_wrapped",
          "vault_key_version",
          "schema_version"
        ],
        "type": "object"
      },
      "MoveMode": {
        "description": "Whether the source item is deleted after the target copy is written.",
        "enum": [
          "move",
          "copy"
        ],
        "type": "string"
      },
      "MoveRequest": {
        "description": "`POST /v1/item-moves` body.",
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/MoveItem"
            },
            "type": "array"
          },
          "mode": {
            "$ref": "#/components/schemas/MoveMode"
          },
          "source_vault_id": {
            "format": "uuid",
            "type": "string"
          },
          "target_vault_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "source_vault_id",
          "target_vault_id",
          "items"
        ],
        "type": "object"
      },
      "MoveResponse": {
        "description": "The answer to a move that applied.",
        "properties": {
          "moved": {
            "items": {
              "$ref": "#/components/schemas/MovedItem"
            },
            "type": "array"
          },
          "source_revision": {
            "description": "The source vault's revision after the move. It is unchanged for a copy.",
            "format": "int64",
            "type": "integer"
          },
          "target_revision": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "source_revision",
          "target_revision",
          "moved"
        ],
        "type": "object"
      },
      "MovedItem": {
        "description": "One moved item.",
        "properties": {
          "item_id": {
            "format": "uuid",
            "type": "string"
          },
          "new_item_id": {
            "format": "uuid",
            "type": "string"
          },
          "version": {
            "description": "The new item's version, always 1.",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "item_id",
          "new_item_id",
          "version"
        ],
        "type": "object"
      },
      "Mutation": {
        "description": "One entry of a push (API.md §5.2). Content fields are present only on `upsert`.",
        "properties": {
          "base_version": {
            "description": "The item version this change was made on. `None` creates a new item.",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "details_ct": {
            "format": "byte",
            "type": [
              "string",
              "null"
            ]
          },
          "item_id": {
            "format": "uuid",
            "type": "string"
          },
          "item_key_wrapped": {
            "format": "byte",
            "type": [
              "string",
              "null"
            ]
          },
          "op": {
            "$ref": "#/components/schemas/MutationOp"
          },
          "overview_ct": {
            "format": "byte",
            "type": [
              "string",
              "null"
            ]
          },
          "schema_version": {
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "vault_key_version": {
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          }
        },
        "required": [
          "op",
          "item_id"
        ],
        "type": "object"
      },
      "MutationOp": {
        "description": "Mutation operations.",
        "enum": [
          "upsert",
          "trash",
          "restore",
          "delete"
        ],
        "type": "string"
      },
      "MyGroupKey": {
        "description": "The caller's own sealed copy of a group key.",
        "properties": {
          "granted_by": {
            "description": "Who sealed it.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "granter_sign_public_key": {
            "description": "The granter's current Ed25519 public key, base64url, to check the seal's signature.",
            "type": [
              "string",
              "null"
            ]
          },
          "group_key_wrapped": {
            "description": "The group private key sealed to the caller's keyset `enc` key, base64url.",
            "type": "string"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "key_version",
          "group_key_wrapped"
        ],
        "type": "object"
      },
      "OidcTrustPolicy": {
        "properties": {
          "audiences": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "claim_conditions": {
            "type": "object"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "identity_id": {
            "format": "uuid",
            "type": "string"
          },
          "issuer": {
            "type": "string"
          },
          "jwks_uri": {
            "type": [
              "string",
              "null"
            ]
          },
          "provider": {
            "type": "string"
          },
          "subject_pattern": {
            "type": "string"
          },
          "token_ttl_seconds": {
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "id",
          "identity_id",
          "provider",
          "issuer",
          "audiences",
          "subject_pattern",
          "claim_conditions",
          "token_ttl_seconds",
          "created_at"
        ],
        "type": "object"
      },
      "OidcTrustPolicyIn": {
        "description": "A trust policy: which workload tokens may sign in as a machine identity (API.md §3.3).",
        "properties": {
          "audiences": {
            "description": "The token's `aud` must contain one of these.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "claim_conditions": {
            "description": "Other claims that must match, for example `{\"repository_owner\": \"SiliconBlast\"}`. Values\nare strings with the same `*` wildcard. An array claim matches when one element does.",
            "type": "object"
          },
          "issuer": {
            "description": "The token's `iss`, exactly.",
            "type": "string"
          },
          "jwks_uri": {
            "description": "A JWKS URL for issuers without OIDC discovery. Default: discovery from the issuer.",
            "type": [
              "string",
              "null"
            ]
          },
          "provider": {
            "description": "`github`, `gitlab`, `gcp`, `aws`, `azure`, `kubernetes`, `forgejo` or `custom`. Display\nonly. The checks are the same for every provider.",
            "type": "string"
          },
          "subject_pattern": {
            "description": "The token's `sub`. `*` matches any run of characters.",
            "type": "string"
          },
          "token_ttl_seconds": {
            "description": "Lifetime of the Sphragis access token, 60 to 3600 seconds. Default 900.",
            "format": "int32",
            "minimum": 0,
            "type": [
              "integer",
              "null"
            ]
          }
        },
        "required": [
          "issuer",
          "audiences",
          "subject_pattern"
        ],
        "type": "object"
      },
      "Page_Environment": {
        "description": "A page of results.",
        "properties": {
          "data": {
            "items": {
              "properties": {
                "encryption_mode": {
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/EncryptionMode",
                      "description": "The project's mode, so clients know whether to expect sealed values."
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "id": {
                  "format": "uuid",
                  "type": "string"
                },
                "key_version": {
                  "format": "int32",
                  "type": "integer"
                },
                "name": {
                  "type": "string"
                },
                "position": {
                  "format": "int32",
                  "type": "integer"
                },
                "project_id": {
                  "format": "uuid",
                  "type": "string"
                },
                "protected": {
                  "type": "boolean"
                },
                "revision": {
                  "format": "int64",
                  "type": "integer"
                },
                "slug": {
                  "type": "string"
                }
              },
              "required": [
                "id",
                "project_id",
                "slug",
                "name",
                "protected",
                "revision",
                "key_version",
                "position"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "Page_Folder": {
        "description": "A page of results.",
        "properties": {
          "data": {
            "items": {
              "properties": {
                "environment_id": {
                  "format": "uuid",
                  "type": "string"
                },
                "id": {
                  "format": "uuid",
                  "type": "string"
                },
                "lookup_hmac": {
                  "$ref": "#/components/schemas/B64"
                },
                "name_ct": {
                  "$ref": "#/components/schemas/B64"
                },
                "parent_id": {
                  "format": "uuid",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "path": {
                  "type": [
                    "string",
                    "null"
                  ]
                }
              },
              "required": [
                "id",
                "environment_id",
                "lookup_hmac",
                "name_ct"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "Page_Identity": {
        "description": "A page of results.",
        "properties": {
          "data": {
            "items": {
              "properties": {
                "account_id": {
                  "format": "uuid",
                  "type": "string"
                },
                "created_at": {
                  "format": "date-time",
                  "type": "string"
                },
                "description": {
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "disabled_at": {
                  "format": "date-time",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "enc_public_key": {
                  "$ref": "#/components/schemas/B64"
                },
                "id": {
                  "format": "uuid",
                  "type": "string"
                },
                "name": {
                  "type": "string"
                }
              },
              "required": [
                "id",
                "account_id",
                "name",
                "enc_public_key",
                "created_at"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "Page_OidcTrustPolicy": {
        "description": "A page of results.",
        "properties": {
          "data": {
            "items": {
              "properties": {
                "audiences": {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                "claim_conditions": {
                  "type": "object"
                },
                "created_at": {
                  "format": "date-time",
                  "type": "string"
                },
                "id": {
                  "format": "uuid",
                  "type": "string"
                },
                "identity_id": {
                  "format": "uuid",
                  "type": "string"
                },
                "issuer": {
                  "type": "string"
                },
                "jwks_uri": {
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "provider": {
                  "type": "string"
                },
                "subject_pattern": {
                  "type": "string"
                },
                "token_ttl_seconds": {
                  "format": "int32",
                  "minimum": 0,
                  "type": "integer"
                }
              },
              "required": [
                "id",
                "identity_id",
                "provider",
                "issuer",
                "audiences",
                "subject_pattern",
                "claim_conditions",
                "token_ttl_seconds",
                "created_at"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "Page_Project": {
        "description": "A page of results.",
        "properties": {
          "data": {
            "items": {
              "properties": {
                "account_id": {
                  "format": "uuid",
                  "type": "string"
                },
                "created_at": {
                  "format": "date-time",
                  "type": "string"
                },
                "encryption_mode": {
                  "$ref": "#/components/schemas/EncryptionMode"
                },
                "id": {
                  "format": "uuid",
                  "type": "string"
                },
                "key_provider": {
                  "description": "Where the project key lives in Managed mode: `keyd` or a customer KMS. Absent for\nZero-knowledge projects.",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "name": {
                  "type": "string"
                },
                "region": {
                  "type": "string"
                },
                "slug": {
                  "type": "string"
                }
              },
              "required": [
                "id",
                "account_id",
                "slug",
                "name",
                "encryption_mode",
                "region",
                "created_at"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "Page_RoleBinding": {
        "description": "A page of results.",
        "properties": {
          "data": {
            "items": {
              "properties": {
                "created_at": {
                  "format": "date-time",
                  "type": "string"
                },
                "expires_at": {
                  "format": "date-time",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "id": {
                  "format": "uuid",
                  "type": "string"
                },
                "principal_id": {
                  "format": "uuid",
                  "type": "string"
                },
                "principal_type": {
                  "$ref": "#/components/schemas/PrincipalType"
                },
                "role_id": {
                  "format": "uuid",
                  "type": "string"
                },
                "role_name": {
                  "type": "string"
                },
                "scope_id": {
                  "format": "uuid",
                  "type": "string"
                },
                "scope_type": {
                  "type": "string"
                }
              },
              "required": [
                "id",
                "role_id",
                "role_name",
                "principal_type",
                "principal_id",
                "scope_type",
                "scope_id",
                "created_at"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "Page_TokenInfo": {
        "description": "A page of results.",
        "properties": {
          "data": {
            "items": {
              "properties": {
                "allowed_cidrs": {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                "created_at": {
                  "format": "date-time",
                  "type": "string"
                },
                "display_prefix": {
                  "type": "string"
                },
                "expires_at": {
                  "format": "date-time",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "id": {
                  "format": "uuid",
                  "type": "string"
                },
                "identity_id": {
                  "format": "uuid",
                  "type": "string"
                },
                "last_used_at": {
                  "format": "date-time",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "name": {
                  "type": "string"
                },
                "revoked_at": {
                  "format": "date-time",
                  "type": [
                    "string",
                    "null"
                  ]
                }
              },
              "required": [
                "id",
                "identity_id",
                "name",
                "display_prefix",
                "allowed_cidrs",
                "created_at"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "Page_Webhook": {
        "description": "A page of results.",
        "properties": {
          "data": {
            "items": {
              "properties": {
                "active": {
                  "type": "boolean"
                },
                "consecutive_failures": {
                  "format": "int32",
                  "type": "integer"
                },
                "created_at": {
                  "format": "date-time",
                  "type": "string"
                },
                "description": {
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "disabled_reason": {
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "event_types": {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                "id": {
                  "format": "uuid",
                  "type": "string"
                },
                "previous_secret_expires_at": {
                  "description": "After a signing secret rotation, deliveries carry a second `v1` signature made with the\nold secret until this time.",
                  "format": "date-time",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "project_id": {
                  "format": "uuid",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "url": {
                  "type": "string"
                }
              },
              "required": [
                "id",
                "url",
                "event_types",
                "active",
                "consecutive_failures",
                "created_at"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "Page_WebhookDelivery": {
        "description": "A page of results.",
        "properties": {
          "data": {
            "items": {
              "properties": {
                "attempt": {
                  "format": "int32",
                  "type": "integer"
                },
                "created_at": {
                  "format": "date-time",
                  "type": "string"
                },
                "event_id": {
                  "format": "uuid",
                  "type": "string"
                },
                "event_type": {
                  "type": "string"
                },
                "id": {
                  "format": "uuid",
                  "type": "string"
                },
                "next_attempt_at": {
                  "format": "date-time",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "response_code": {
                  "format": "int32",
                  "type": [
                    "integer",
                    "null"
                  ]
                },
                "status": {
                  "description": "`pending`, `succeeded`, `failed` or `abandoned`.",
                  "type": "string"
                }
              },
              "required": [
                "id",
                "event_id",
                "event_type",
                "attempt",
                "status",
                "created_at"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "PasskeyCreationOptions": {
        "description": "Creation options for a new unlock passkey.",
        "properties": {
          "challenge_id": {
            "type": "string"
          },
          "public_key": {
            "description": "`PublicKeyCredentialCreationOptionsJSON`. The client adds the PRF extension input.",
            "type": "object"
          }
        },
        "required": [
          "challenge_id",
          "public_key"
        ],
        "type": "object"
      },
      "PasskeyInfo": {
        "description": "One unlock passkey in the settings list.",
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_used_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "created_at"
        ],
        "type": "object"
      },
      "PasskeyList": {
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/PasskeyInfo"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "PasskeyRegistration": {
        "additionalProperties": false,
        "description": "`POST /v1/me/unlock-passkeys` body.",
        "properties": {
          "authenticator_data": {
            "type": "string"
          },
          "challenge_id": {
            "type": "string"
          },
          "client_data_json": {
            "type": "string"
          },
          "credential_id": {
            "type": "string"
          },
          "name": {
            "description": "Label the person chose, for example \"Phone\".",
            "type": "string"
          },
          "prf_salt": {
            "description": "32 random bytes the client chose as the PRF input.",
            "type": "string"
          },
          "public_key": {
            "description": "`response.getPublicKey()`: SubjectPublicKeyInfo DER.",
            "type": "string"
          },
          "public_key_algorithm": {
            "description": "`response.getPublicKeyAlgorithm()`: -7 or -8.",
            "format": "int32",
            "type": "integer"
          },
          "transports": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "wrapped_auk": {
            "description": "The AUK encrypted under `PUK` (alg `0x01`, context `{part: \"prf-unlock\", credential_id}`).",
            "type": "string"
          }
        },
        "required": [
          "challenge_id",
          "name",
          "credential_id",
          "client_data_json",
          "authenticator_data",
          "public_key",
          "public_key_algorithm",
          "prf_salt",
          "wrapped_auk"
        ],
        "type": "object"
      },
      "PasskeyRequestOptions": {
        "description": "Request options for passkey unlock.",
        "properties": {
          "challenge_id": {
            "type": "string"
          },
          "prf_salts": {
            "additionalProperties": {
              "type": "string"
            },
            "description": "PRF input per credential id, both base64url.",
            "propertyNames": {
              "type": "string"
            },
            "type": "object"
          },
          "public_key": {
            "description": "`PublicKeyCredentialRequestOptionsJSON`. Empty `allowCredentials` means the person has no\nunlock passkey.",
            "type": "object"
          }
        },
        "required": [
          "challenge_id",
          "public_key",
          "prf_salts"
        ],
        "type": "object"
      },
      "PasskeyUnlock": {
        "additionalProperties": false,
        "description": "`POST /v1/unlock/passkey/finish` body.",
        "properties": {
          "authenticator_data": {
            "type": "string"
          },
          "challenge_id": {
            "type": "string"
          },
          "client_data_json": {
            "type": "string"
          },
          "credential_id": {
            "type": "string"
          },
          "device": {
            "$ref": "#/components/schemas/DeviceInput"
          },
          "signature": {
            "type": "string"
          }
        },
        "required": [
          "challenge_id",
          "credential_id",
          "client_data_json",
          "authenticator_data",
          "signature",
          "device"
        ],
        "type": "object"
      },
      "PasskeyUnlocked": {
        "allOf": [
          {
            "$ref": "#/components/schemas/Unlocked"
          },
          {
            "properties": {
              "credential_id": {
                "type": "string"
              },
              "prf_salt": {
                "description": "The PRF input this passkey was registered with.",
                "type": "string"
              },
              "wrapped_auk": {
                "description": "The AUK under `PUK`. Only the authenticator's PRF output opens it.",
                "type": "string"
              }
            },
            "required": [
              "credential_id",
              "wrapped_auk",
              "prf_salt"
            ],
            "type": "object"
          }
        ],
        "description": "`POST /v1/unlock/passkey/finish` response."
      },
      "PlanPrice": {
        "description": "One price of a plan in the caller's region.",
        "properties": {
          "interval": {
            "description": "`month` or `year`.",
            "type": "string"
          },
          "unit_amount": {
            "description": "Cents in `currency`, for the account or for each seat.",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "interval",
          "unit_amount"
        ],
        "type": "object"
      },
      "PlanView": {
        "description": "A plan as the catalog defines it.",
        "properties": {
          "features": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "id": {
            "type": "string"
          },
          "limits": {
            "description": "The `entitlements.limits` object for the plan at its minimum seats.",
            "type": "object"
          },
          "max_seats": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "min_seats": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "per": {
            "description": "`account` or `seat`. Absent for plans without a price.",
            "type": [
              "string",
              "null"
            ]
          },
          "prices": {
            "items": {
              "$ref": "#/components/schemas/PlanPrice"
            },
            "type": "array"
          },
          "self_serve": {
            "type": "boolean"
          },
          "trial_days": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "name",
          "self_serve",
          "prices",
          "trial_days",
          "min_seats",
          "limits",
          "features"
        ],
        "type": "object"
      },
      "PlansView": {
        "description": "The catalog for one region.",
        "properties": {
          "currency": {
            "type": "string"
          },
          "grace_days": {
            "format": "int64",
            "type": "integer"
          },
          "metered_unit": {
            "format": "int64",
            "type": "integer"
          },
          "metered_unit_price": {
            "description": "Cents per `metered_unit` Secrets operations above the quota.",
            "format": "int64",
            "type": "integer"
          },
          "plans": {
            "items": {
              "$ref": "#/components/schemas/PlanView"
            },
            "type": "array"
          },
          "region": {
            "type": "string"
          }
        },
        "required": [
          "currency",
          "region",
          "plans",
          "metered_unit_price",
          "metered_unit",
          "grace_days"
        ],
        "type": "object"
      },
      "Policies": {
        "additionalProperties": false,
        "description": "The policy document. This build knows one policy (ORG-04 adds the rest).",
        "properties": {
          "require_2fa": {
            "description": "Members must use a second factor at SiliconBlast for sensitive actions and to join.",
            "type": "boolean"
          }
        },
        "required": [
          "require_2fa"
        ],
        "type": "object"
      },
      "PrincipalType": {
        "description": "`user`, `group` or `machine`.",
        "enum": [
          "user",
          "group",
          "machine"
        ],
        "type": "string"
      },
      "Project": {
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "encryption_mode": {
            "$ref": "#/components/schemas/EncryptionMode"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "key_provider": {
            "description": "Where the project key lives in Managed mode: `keyd` or a customer KMS. Absent for\nZero-knowledge projects.",
            "type": [
              "string",
              "null"
            ]
          },
          "name": {
            "type": "string"
          },
          "region": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "account_id",
          "slug",
          "name",
          "encryption_mode",
          "region",
          "created_at"
        ],
        "type": "object"
      },
      "PublicJwk": {
        "additionalProperties": false,
        "description": "A device's public proof key as a JWK. Private members are refused.",
        "properties": {
          "crv": {
            "type": "string"
          },
          "kty": {
            "type": "string"
          },
          "x": {
            "type": "string"
          },
          "y": {
            "type": "string"
          }
        },
        "required": [
          "kty",
          "crv",
          "x",
          "y"
        ],
        "type": "object"
      },
      "PublicKeys": {
        "description": "A person's public key bundle, as they signed it (CRYPTOGRAPHY.md §5, §7.1).",
        "properties": {
          "bundle_sig": {
            "description": "Ed25519 signature by `sig_pk` over the JCS form of `public_bundle`, base64url.",
            "type": "string"
          },
          "display_name": {
            "type": [
              "string",
              "null"
            ]
          },
          "email": {
            "type": "string"
          },
          "keyset_version": {
            "format": "int32",
            "type": "integer"
          },
          "public_bundle": {
            "description": "`{ user_id, keyset_version, enc_pk, sig_pk, org_member_pks, created_at }`.",
            "type": "object"
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "keyset_version",
          "public_bundle",
          "bundle_sig",
          "email"
        ],
        "type": "object"
      },
      "PublicShareLink": {
        "description": "What the share page receives.",
        "properties": {
          "expires_at": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "passphrase_salt": {
            "description": "The Argon2id salt when the link needs a passphrase, base64url.",
            "type": [
              "string",
              "null"
            ]
          },
          "snapshot_ct": {
            "description": "The snapshot ciphertext, base64url. Present only when `Share-Auth` was valid.",
            "type": [
              "string",
              "null"
            ]
          },
          "views_left": {
            "description": "Views left after this one, when the link has a limit.",
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "expires_at"
        ],
        "type": "object"
      },
      "PushRequest": {
        "description": "`POST /v1/vaults/{id}/mutations` body.",
        "properties": {
          "base_revision": {
            "format": "int64",
            "type": "integer"
          },
          "mutations": {
            "items": {
              "$ref": "#/components/schemas/Mutation"
            },
            "type": "array"
          }
        },
        "required": [
          "base_revision",
          "mutations"
        ],
        "type": "object"
      },
      "PushResponse": {
        "description": "The push answer. The server sends it with `200` when nothing conflicts and with `409\nsync.conflict` (plus the problem fields) when something does.",
        "properties": {
          "applied": {
            "items": {
              "$ref": "#/components/schemas/Applied"
            },
            "type": "array"
          },
          "conflicts": {
            "items": {
              "$ref": "#/components/schemas/Conflict"
            },
            "type": "array"
          },
          "new_revision": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "applied",
          "new_revision"
        ],
        "type": "object"
      },
      "PutEscrow": {
        "description": "`PUT /v1/secrets/identities/{id}/escrow/{user}`: a copy sealed to that person.",
        "properties": {
          "escrow_version": {
            "format": "int32",
            "type": "integer"
          },
          "seed_sealed": {
            "$ref": "#/components/schemas/B64"
          }
        },
        "required": [
          "escrow_version",
          "seed_sealed"
        ],
        "type": "object"
      },
      "PutGrant": {
        "description": "Body of a grant upsert.",
        "properties": {
          "env_key_wrapped": {
            "$ref": "#/components/schemas/B64"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "key_version",
          "env_key_wrapped"
        ],
        "type": "object"
      },
      "PutGroupMember": {
        "additionalProperties": false,
        "description": "`PUT /v1/accounts/{id}/groups/{gid}/members/{user}` body.",
        "properties": {
          "group_key_wrapped": {
            "description": "The group private key sealed (`0x11`) to the member's keyset `enc` key.",
            "format": "byte",
            "type": "string"
          },
          "key_version": {
            "description": "The group's current key version.",
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "key_version",
          "group_key_wrapped"
        ],
        "type": "object"
      },
      "Ready": {
        "properties": {
          "database": {
            "type": "boolean"
          },
          "redis": {
            "type": [
              "boolean",
              "null"
            ]
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "status",
          "database"
        ],
        "type": "object"
      },
      "RecordExport": {
        "additionalProperties": false,
        "description": "An export the client is about to hand over.",
        "properties": {
          "format": {
            "description": "`sphx` (encrypted), `cxf`, `csv`, `json` or `otpauth-migration`.",
            "type": "string"
          },
          "item_count": {
            "description": "Items in the file.",
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "format",
          "item_count"
        ],
        "type": "object"
      },
      "Recovered": {
        "allOf": [
          {
            "$ref": "#/components/schemas/Unlocked"
          },
          {
            "properties": {
              "secret_key_version": {
                "format": "int32",
                "type": "integer"
              },
              "sessions_revoked": {
                "description": "How many earlier sessions of the person the recovery ended. The new session is not\ncounted.",
                "format": "int64",
                "minimum": 0,
                "type": "integer"
              }
            },
            "required": [
              "secret_key_version",
              "sessions_revoked"
            ],
            "type": "object"
          }
        ],
        "description": "`POST /v1/recovery/finish` response."
      },
      "RecoveryChallenge": {
        "description": "`POST /v1/recovery/start` response.",
        "properties": {
          "keyset": {
            "$ref": "#/components/schemas/KeysetDocument",
            "description": "The keyset under the recovery code's key, with the public bundle to check it against."
          },
          "recovery_id": {
            "type": "string"
          },
          "registration_response": {
            "type": "string"
          }
        },
        "required": [
          "recovery_id",
          "keyset",
          "registration_response"
        ],
        "type": "object"
      },
      "RecoveryCodeInfo": {
        "description": "A recovery code as the settings screen lists it. The code itself is never stored.",
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "id",
          "created_at"
        ],
        "type": "object"
      },
      "RecoveryCodeList": {
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/RecoveryCodeInfo"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "RecoveryCodeUpload": {
        "additionalProperties": false,
        "description": "One recovery code as the client uploads it (CRYPTOGRAPHY.md §10.1).",
        "properties": {
          "envelope": {
            "description": "The keyset CBOR encrypted under `RK`.",
            "type": "string"
          },
          "id": {
            "description": "Client-chosen UUID for the code.",
            "format": "uuid",
            "type": "string"
          },
          "keyset_version": {
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "verifier": {
            "description": "`H(HKDF(RC, account_id, \"sphragis/v1/recovery-auth\"))`, 32 bytes.",
            "type": "string"
          }
        },
        "required": [
          "id",
          "verifier",
          "keyset_version",
          "envelope"
        ],
        "type": "object"
      },
      "RecoveryFinish": {
        "additionalProperties": false,
        "description": "`POST /v1/recovery/finish` body.",
        "properties": {
          "device": {
            "$ref": "#/components/schemas/DeviceInput"
          },
          "kdf": {
            "$ref": "#/components/schemas/KdfParams"
          },
          "keyset": {
            "$ref": "#/components/schemas/RewrappedKeyset"
          },
          "recovery_codes": {
            "description": "The new recovery code that replaces the one used.",
            "items": {
              "$ref": "#/components/schemas/RecoveryCodeUpload"
            },
            "type": "array"
          },
          "recovery_id": {
            "type": "string"
          },
          "registration_upload": {
            "type": "string"
          },
          "secret_key_id": {
            "type": "string"
          },
          "secret_key_rotated": {
            "description": "True when the client also made a new Secret Key, because this device did not have one.",
            "type": "boolean"
          }
        },
        "required": [
          "recovery_id",
          "registration_upload",
          "kdf",
          "secret_key_id",
          "secret_key_rotated",
          "keyset",
          "recovery_codes",
          "device"
        ],
        "type": "object"
      },
      "RecoveryStart": {
        "additionalProperties": false,
        "description": "`POST /v1/recovery/start` body.",
        "properties": {
          "proof": {
            "description": "`HKDF(RC, account_id, \"sphragis/v1/recovery-auth\")`, 32 bytes.",
            "type": "string"
          },
          "registration_request": {
            "description": "OPAQUE registration request for the new master password.",
            "type": "string"
          }
        },
        "required": [
          "proof",
          "registration_request"
        ],
        "type": "object"
      },
      "RedirectView": {
        "description": "A Stripe-hosted page to send the person to.",
        "properties": {
          "url": {
            "type": "string"
          }
        },
        "required": [
          "url"
        ],
        "type": "object"
      },
      "RegisterFinish": {
        "additionalProperties": false,
        "description": "`POST /v1/register/finish` body.",
        "properties": {
          "device": {
            "$ref": "#/components/schemas/DeviceInput"
          },
          "kdf": {
            "$ref": "#/components/schemas/KdfParams"
          },
          "keyset": {
            "$ref": "#/components/schemas/KeysetDocument"
          },
          "recovery_codes": {
            "description": "The first recovery code, generated at setup (CRYPTOGRAPHY.md §10.1). Optional so older\nclients still register.",
            "items": {
              "$ref": "#/components/schemas/RecoveryCodeUpload"
            },
            "type": "array"
          },
          "registration_upload": {
            "type": "string"
          },
          "secret_key_id": {
            "type": "string"
          }
        },
        "required": [
          "registration_upload",
          "kdf",
          "secret_key_id",
          "keyset",
          "device"
        ],
        "type": "object"
      },
      "RegisterRequest": {
        "description": "`POST /v1/sib/register`.",
        "properties": {
          "client_id": {
            "type": "string"
          },
          "email": {
            "type": "string"
          },
          "first_name": {
            "type": [
              "string",
              "null"
            ]
          },
          "last_name": {
            "type": [
              "string",
              "null"
            ]
          },
          "password": {
            "type": "string"
          }
        },
        "required": [
          "client_id",
          "email",
          "password"
        ],
        "type": "object"
      },
      "RegisterStartBody": {
        "additionalProperties": false,
        "properties": {
          "registration_request": {
            "type": "string"
          }
        },
        "required": [
          "registration_request"
        ],
        "type": "object"
      },
      "RegisterStartResponse": {
        "properties": {
          "registration_response": {
            "type": "string"
          }
        },
        "required": [
          "registration_response"
        ],
        "type": "object"
      },
      "Registered": {
        "description": "`POST /v1/register/finish` response.",
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "device_id": {
            "format": "uuid",
            "type": "string"
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "account_id",
          "device_id"
        ],
        "type": "object"
      },
      "RekeyGrant": {
        "description": "One re-sealed grant in a rotation.",
        "properties": {
          "principal_id": {
            "format": "uuid",
            "type": "string"
          },
          "principal_type": {
            "description": "`user` or `group`.",
            "type": "string"
          },
          "vault_key_wrapped": {
            "description": "The new vault key sealed to the principal and signed by the caller.",
            "format": "byte",
            "type": "string"
          }
        },
        "required": [
          "principal_type",
          "principal_id",
          "vault_key_wrapped"
        ],
        "type": "object"
      },
      "RekeyItem": {
        "description": "One item key wrapped under the new vault key.",
        "properties": {
          "item_id": {
            "format": "uuid",
            "type": "string"
          },
          "item_key_wrapped": {
            "format": "byte",
            "type": "string"
          },
          "version": {
            "description": "The item version the client re-wrapped. A newer version on the server makes the request\nstale.",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "item_id",
          "version",
          "item_key_wrapped"
        ],
        "type": "object"
      },
      "RekeyVault": {
        "description": "`POST /v1/vaults/{id}:rekey` body.",
        "properties": {
          "attrs_ct": {
            "description": "Vault attributes encrypted under the new key.",
            "format": "byte",
            "type": "string"
          },
          "grants": {
            "description": "Exactly one entry for every principal that keeps access.",
            "items": {
              "$ref": "#/components/schemas/RekeyGrant"
            },
            "type": "array"
          },
          "items": {
            "description": "Exactly one entry for every item in the vault, trashed ones included.",
            "items": {
              "$ref": "#/components/schemas/RekeyItem"
            },
            "type": "array"
          },
          "key_version": {
            "description": "The new vault key version: the current one plus one.",
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "key_version",
          "attrs_ct",
          "grants",
          "items"
        ],
        "type": "object"
      },
      "Removed": {
        "description": "What a removal leaves for the remaining members' clients to rotate (CRYPTOGRAPHY.md §11.4).",
        "properties": {
          "rekey_vaults": {
            "description": "Vaults the removed person could open, directly or through a group. Rekey each.",
            "items": {
              "format": "uuid",
              "type": "string"
            },
            "type": "array"
          },
          "rotate_groups": {
            "description": "Groups whose key the removed person held. Rotate each with `:rotate`.",
            "items": {
              "format": "uuid",
              "type": "string"
            },
            "type": "array"
          }
        },
        "required": [
          "rotate_groups",
          "rekey_vaults"
        ],
        "type": "object"
      },
      "RenameAccount": {
        "additionalProperties": false,
        "description": "`PATCH /v1/accounts/{id}` body.",
        "properties": {
          "name": {
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "RenameDevice": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "RenameGroup": {
        "additionalProperties": false,
        "description": "`PATCH /v1/accounts/{id}/groups/{gid}` body.",
        "properties": {
          "name": {
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "RenamedDevice": {
        "properties": {
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name"
        ],
        "type": "object"
      },
      "ReplaceCodes": {
        "additionalProperties": false,
        "description": "`POST /v1/recovery/codes` body.",
        "properties": {
          "codes": {
            "items": {
              "$ref": "#/components/schemas/RecoveryCodeUpload"
            },
            "type": "array"
          }
        },
        "required": [
          "codes"
        ],
        "type": "object"
      },
      "ResetPasswordRequest": {
        "description": "`POST /v1/sib/reset-password`.",
        "properties": {
          "password": {
            "type": "string"
          },
          "token": {
            "description": "The `token` from the emailed link.",
            "type": "string"
          }
        },
        "required": [
          "token",
          "password"
        ],
        "type": "object"
      },
      "RevokeRequest": {
        "description": "`POST /v1/sib/revoke`.",
        "properties": {
          "client_id": {
            "type": "string"
          },
          "refresh_token": {
            "description": "Clients other than the web vault send their refresh token here.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "client_id"
        ],
        "type": "object"
      },
      "Revoked": {
        "description": "Revoke answer.",
        "properties": {
          "rekey_recommended": {
            "description": "The revoked principal may have kept the vault key, so the client should rotate it.",
            "type": "boolean"
          }
        },
        "required": [
          "rekey_recommended"
        ],
        "type": "object"
      },
      "RevokedAll": {
        "properties": {
          "revoked": {
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "revoked"
        ],
        "type": "object"
      },
      "RewrappedKeyset": {
        "additionalProperties": false,
        "description": "The keyset as re-wrapped by a rotation: the same version under a new key.",
        "properties": {
          "envelope": {
            "description": "The keyset CBOR encrypted under the new AUK.",
            "type": "string"
          },
          "version": {
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "version",
          "envelope"
        ],
        "type": "object"
      },
      "RoleBinding": {
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "principal_id": {
            "format": "uuid",
            "type": "string"
          },
          "principal_type": {
            "$ref": "#/components/schemas/PrincipalType"
          },
          "role_id": {
            "format": "uuid",
            "type": "string"
          },
          "role_name": {
            "type": "string"
          },
          "scope_id": {
            "format": "uuid",
            "type": "string"
          },
          "scope_type": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "role_id",
          "role_name",
          "principal_type",
          "principal_id",
          "scope_type",
          "scope_id",
          "created_at"
        ],
        "type": "object"
      },
      "Rollback": {
        "description": "`POST /v1/secrets/environments/{e}:rollback`. The server writes a new version for every secret\nwhose newest version differs from the snapshot, deletes secrets created after `at` and\nrecovers secrets deleted after it. Zero-knowledge clients seal the new versions themselves and\nsend them in `versions`. Managed projects leave `versions` empty.",
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "versions": {
            "items": {
              "$ref": "#/components/schemas/RollbackVersion"
            },
            "type": "array"
          }
        },
        "required": [
          "at"
        ],
        "type": "object"
      },
      "RollbackResult": {
        "properties": {
          "deleted": {
            "items": {
              "format": "uuid",
              "type": "string"
            },
            "type": "array"
          },
          "environment_revision": {
            "format": "int64",
            "type": "integer"
          },
          "recovered": {
            "items": {
              "format": "uuid",
              "type": "string"
            },
            "type": "array"
          },
          "restored": {
            "description": "Secrets that got a new version, with its number.",
            "items": {
              "$ref": "#/components/schemas/BatchWriteOutcome"
            },
            "type": "array"
          }
        },
        "required": [
          "environment_revision",
          "restored",
          "deleted",
          "recovered"
        ],
        "type": "object"
      },
      "RollbackVersion": {
        "description": "One new version a Zero-knowledge client sealed for a rollback.",
        "properties": {
          "new_version": {
            "description": "The version number the client sealed for: the secret's newest version plus one. The server\nrefuses the rollback when another write took that number first.",
            "format": "int32",
            "type": "integer"
          },
          "secret_id": {
            "format": "uuid",
            "type": "string"
          },
          "version": {
            "$ref": "#/components/schemas/VersionIn"
          }
        },
        "required": [
          "secret_id",
          "new_version",
          "version"
        ],
        "type": "object"
      },
      "RotateGroup": {
        "additionalProperties": false,
        "description": "`:rotate` body.",
        "properties": {
          "enc_public_key": {
            "format": "byte",
            "type": "string"
          },
          "key_version": {
            "description": "The current key version plus one.",
            "format": "int32",
            "type": "integer"
          },
          "members": {
            "description": "The new key sealed to every current member, no more and no fewer.",
            "items": {
              "$ref": "#/components/schemas/GroupKeyGrant"
            },
            "type": "array"
          },
          "vaults": {
            "description": "Every vault granted to the group, re-sealed to the new key.",
            "items": {
              "$ref": "#/components/schemas/GroupVaultGrant"
            },
            "type": "array"
          }
        },
        "required": [
          "key_version",
          "enc_public_key",
          "members"
        ],
        "type": "object"
      },
      "RotateKeyset": {
        "additionalProperties": false,
        "description": "`POST /v1/me/keyset:rotate` body.",
        "properties": {
          "kdf": {
            "$ref": "#/components/schemas/KdfParams"
          },
          "keyset": {
            "$ref": "#/components/schemas/RewrappedKeyset"
          },
          "kind": {
            "$ref": "#/components/schemas/RotationKind"
          },
          "proof": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/LoginProof",
                "description": "Proof of the current master password. `null` asks for trusted-device recovery (§10.2),\nwhich needs a second-factor step-up."
              },
              {
                "type": "null"
              }
            ]
          },
          "registration_upload": {
            "type": "string"
          },
          "secret_key_id": {
            "type": "string"
          }
        },
        "required": [
          "kind",
          "registration_upload",
          "kdf",
          "secret_key_id",
          "keyset"
        ],
        "type": "object"
      },
      "RotateWebhookSecret": {
        "description": "`POST /v1/webhooks/{id}:rotateSecret`. `overlap_hours` is how long the old secret keeps\nsigning next to the new one: 0 to 168, default 24. Zero drops the old secret at once.",
        "properties": {
          "overlap_hours": {
            "format": "int32",
            "minimum": 0,
            "type": [
              "integer",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "Rotated": {
        "description": "`POST /v1/me/keyset:rotate` response.",
        "properties": {
          "passkeys_removed": {
            "description": "Unlock passkeys removed because they wrapped the old AUK.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "rotated_at": {
            "format": "date-time",
            "type": "string"
          },
          "secret_key_version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "secret_key_version",
          "passkeys_removed",
          "rotated_at"
        ],
        "type": "object"
      },
      "RotationKind": {
        "description": "What a rotation changes.",
        "enum": [
          "password",
          "secret_key"
        ],
        "type": "string"
      },
      "Secret": {
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "created_by": {
            "type": "string"
          },
          "deleted_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "environment_id": {
            "format": "uuid",
            "type": "string"
          },
          "folder_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "latest_version": {
            "format": "int32",
            "type": "integer"
          },
          "lookup_hmac": {
            "$ref": "#/components/schemas/B64"
          },
          "meta_ct": {
            "$ref": "#/components/schemas/B64"
          },
          "path": {
            "type": [
              "string",
              "null"
            ]
          },
          "revision": {
            "format": "int64",
            "type": "integer"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "environment_id",
          "lookup_hmac",
          "meta_ct",
          "latest_version",
          "revision",
          "created_by",
          "created_at",
          "updated_at"
        ],
        "type": "object"
      },
      "SecretList": {
        "description": "The secrets in one environment.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/Secret"
            },
            "type": "array"
          },
          "environment_revision": {
            "format": "int64",
            "type": "integer"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data",
          "environment_revision"
        ],
        "type": "object"
      },
      "ServerTime": {
        "properties": {
          "unix_ms": {
            "description": "Milliseconds since the Unix epoch on the server's clock.",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "unix_ms"
        ],
        "type": "object"
      },
      "SessionGrant": {
        "description": "The session part of an unlock response.",
        "properties": {
          "absolute_expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "idle_expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "token": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "token",
          "idle_expires_at",
          "absolute_expires_at"
        ],
        "type": "object"
      },
      "SessionList": {
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/SessionView"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "SessionView": {
        "description": "A live session as the session list shows it.",
        "properties": {
          "auth_method": {
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "current": {
            "description": "True for the session that made this request.",
            "type": "boolean"
          },
          "device_id": {
            "format": "uuid",
            "type": "string"
          },
          "device_name": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "idle_expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "last_seen_at": {
            "format": "date-time",
            "type": "string"
          },
          "platform": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "device_id",
          "device_name",
          "platform",
          "auth_method",
          "created_at",
          "last_seen_at",
          "idle_expires_at",
          "current"
        ],
        "type": "object"
      },
      "SetAlias": {
        "properties": {
          "version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "version"
        ],
        "type": "object"
      },
      "ShareLink": {
        "description": "A share link as its sender sees it.",
        "properties": {
          "created_at": {
            "type": "string"
          },
          "expires_at": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "item_id": {
            "format": "uuid",
            "type": "string"
          },
          "max_views": {
            "description": "`None` means any number of views until expiry.",
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "passphrase": {
            "description": "The link needs a passphrase as well as the URL.",
            "type": "boolean"
          },
          "state": {
            "description": "`active`, `used` (view limit reached), `expired` or `revoked`.",
            "type": "string"
          },
          "view_count": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "item_id",
          "created_at",
          "expires_at",
          "view_count",
          "passphrase",
          "state"
        ],
        "type": "object"
      },
      "ShareLinkList": {
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ShareLink"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "SibAuthResponse": {
        "description": "SBI's answer, with the refresh token moved into the cookie for web clients. Branch on\n`verification_required` and `mfa_required` before looking for tokens.",
        "properties": {
          "access_token": {
            "type": [
              "string",
              "null"
            ]
          },
          "expires_in": {
            "format": "int64",
            "minimum": 0,
            "type": [
              "integer",
              "null"
            ]
          },
          "id_token": {
            "type": [
              "string",
              "null"
            ]
          },
          "mfa_required": {
            "description": "The person has an authenticator. Send the code with `mfa_token` to `/v1/sib/mfa`.",
            "type": [
              "boolean",
              "null"
            ]
          },
          "mfa_token": {
            "type": [
              "string",
              "null"
            ]
          },
          "refresh_token": {
            "description": "Only for clients other than the web vault.",
            "type": [
              "string",
              "null"
            ]
          },
          "scope": {
            "type": [
              "string",
              "null"
            ]
          },
          "token_type": {
            "type": [
              "string",
              "null"
            ]
          },
          "user": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/SibUser"
              },
              {
                "type": "null"
              }
            ]
          },
          "verification_required": {
            "description": "A new signup. SBI emailed a link and sent no tokens.",
            "type": [
              "boolean",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "SibUser": {
        "description": "The person SBI returns with a headless login or registration.",
        "properties": {
          "email": {
            "type": "string"
          },
          "email_verified": {
            "type": "boolean"
          },
          "first_name": {
            "type": [
              "string",
              "null"
            ]
          },
          "last_name": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "email",
          "email_verified"
        ],
        "type": "object"
      },
      "Snapshot": {
        "description": "An environment at a point in time (`GET /v1/secrets/environments/{e}/snapshot`).",
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "encryption_mode": {
            "$ref": "#/components/schemas/EncryptionMode"
          },
          "environment_id": {
            "format": "uuid",
            "type": "string"
          },
          "environment_revision": {
            "format": "int64",
            "type": "integer"
          },
          "secrets": {
            "items": {
              "$ref": "#/components/schemas/SnapshotSecret"
            },
            "type": "array"
          }
        },
        "required": [
          "environment_id",
          "encryption_mode",
          "at",
          "environment_revision",
          "secrets"
        ],
        "type": "object"
      },
      "SnapshotSecret": {
        "description": "One secret as it stood at a point in time.",
        "properties": {
          "dek_wrapped": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/B64"
              },
              {
                "type": "null"
              }
            ]
          },
          "folder_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "lookup_hmac": {
            "$ref": "#/components/schemas/B64"
          },
          "meta_ct": {
            "$ref": "#/components/schemas/B64"
          },
          "path": {
            "description": "Managed projects only.",
            "type": [
              "string",
              "null"
            ]
          },
          "secret_id": {
            "format": "uuid",
            "type": "string"
          },
          "state": {
            "$ref": "#/components/schemas/VersionState"
          },
          "value_ct": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/B64",
                "description": "Sealed value of that version, Zero-knowledge projects only and only with\n`include_values=true`. The client opens it to compare or roll back values."
              },
              {
                "type": "null"
              }
            ]
          },
          "version": {
            "description": "The newest version written at or before the snapshot time.",
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "secret_id",
          "lookup_hmac",
          "meta_ct",
          "version",
          "state"
        ],
        "type": "object"
      },
      "SubscriptionResponse": {
        "description": "The account's plan, seats and payment state.",
        "properties": {
          "billing_enabled": {
            "description": "True when checkout and the portal can run here.",
            "type": "boolean"
          },
          "current_period_end": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "grace_until": {
            "description": "When grace ends and the account turns read-only.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "interval": {
            "type": [
              "string",
              "null"
            ]
          },
          "members": {
            "format": "int64",
            "type": "integer"
          },
          "plan": {
            "type": "string"
          },
          "portal": {
            "description": "True once the account has a Stripe customer, so the portal opens.",
            "type": "boolean"
          },
          "region": {
            "description": "The pricing region (`standard`, `upper_middle`, `lower_middle`, `low`).",
            "type": "string"
          },
          "seats": {
            "format": "int64",
            "type": "integer"
          },
          "status": {
            "description": "`free`, `trialing`, `active`, `grace`, `read_only` or `canceled`.",
            "type": "string"
          },
          "trial_used": {
            "type": "boolean"
          }
        },
        "required": [
          "plan",
          "status",
          "seats",
          "members",
          "region",
          "portal",
          "trial_used",
          "billing_enabled"
        ],
        "type": "object"
      },
      "TestPermissions": {
        "properties": {
          "permissions": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "scope_id": {
            "format": "uuid",
            "type": "string"
          },
          "scope_type": {
            "type": "string"
          }
        },
        "required": [
          "scope_type",
          "scope_id",
          "permissions"
        ],
        "type": "object"
      },
      "TestPermissionsResult": {
        "properties": {
          "permissions": {
            "items": {
              "type": "string"
            },
            "type": "array"
          }
        },
        "required": [
          "permissions"
        ],
        "type": "object"
      },
      "TokenInfo": {
        "properties": {
          "allowed_cidrs": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "display_prefix": {
            "type": "string"
          },
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "identity_id": {
            "format": "uuid",
            "type": "string"
          },
          "last_used_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "name": {
            "type": "string"
          },
          "revoked_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "identity_id",
          "name",
          "display_prefix",
          "allowed_cidrs",
          "created_at"
        ],
        "type": "object"
      },
      "TokenRequest": {
        "description": "`POST /v1/sib/token`.",
        "properties": {
          "client_id": {
            "type": "string"
          },
          "code": {
            "type": [
              "string",
              "null"
            ]
          },
          "code_verifier": {
            "type": [
              "string",
              "null"
            ]
          },
          "grant_type": {
            "description": "`authorization_code` or `refresh_token`.",
            "type": "string"
          },
          "redirect_uri": {
            "type": [
              "string",
              "null"
            ]
          },
          "refresh_token": {
            "description": "Clients other than the web vault send their refresh token here. The web vault's comes\nfrom the cookie.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "client_id",
          "grant_type"
        ],
        "type": "object"
      },
      "Tombstone": {
        "description": "A permanently deleted item.",
        "properties": {
          "item_id": {
            "format": "uuid",
            "type": "string"
          },
          "revision": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "item_id",
          "revision"
        ],
        "type": "object"
      },
      "TreeHeadView": {
        "description": "A signed tree head over every account's chain head.",
        "properties": {
          "key_id": {
            "type": "string"
          },
          "root": {
            "description": "Merkle root, base64url.",
            "type": "string"
          },
          "signature": {
            "type": "string"
          },
          "signed_at": {
            "type": "string"
          },
          "signed_at_ms": {
            "format": "int64",
            "type": "integer"
          },
          "tree_size": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "tree_size",
          "root",
          "signed_at_ms",
          "signed_at",
          "key_id",
          "signature"
        ],
        "type": "object"
      },
      "UnlockChallenge": {
        "description": "`POST /v1/unlock/start` response.",
        "properties": {
          "ke2": {
            "type": "string"
          },
          "login_id": {
            "type": "string"
          }
        },
        "required": [
          "login_id",
          "ke2"
        ],
        "type": "object"
      },
      "UnlockFinish": {
        "additionalProperties": false,
        "description": "`POST /v1/unlock/finish` body.",
        "properties": {
          "ke3": {
            "type": "string"
          },
          "login_id": {
            "type": "string"
          }
        },
        "required": [
          "login_id",
          "ke3"
        ],
        "type": "object"
      },
      "UnlockParams": {
        "description": "`GET /v1/unlock/params`.",
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "credentials_changed_at": {
            "description": "When the master password or Secret Key last changed, so a device whose unlock fails can\nsay why.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "kdf": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/KdfParams"
              },
              {
                "type": "null"
              }
            ]
          },
          "opaque_suite": {
            "type": "string"
          },
          "registered": {
            "type": "boolean"
          },
          "secret_key_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "secret_key_version": {
            "description": "Counts Secret Key rotations (CRYPTOGRAPHY.md §11.2). A device whose stored key is older\nasks for the new one.",
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "account_id",
          "registered",
          "opaque_suite"
        ],
        "type": "object"
      },
      "UnlockStart": {
        "additionalProperties": false,
        "description": "`POST /v1/unlock/start` body.",
        "properties": {
          "device": {
            "$ref": "#/components/schemas/DeviceInput"
          },
          "ke1": {
            "type": "string"
          }
        },
        "required": [
          "ke1",
          "device"
        ],
        "type": "object"
      },
      "Unlocked": {
        "description": "`POST /v1/unlock/finish` response.",
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "accounts": {
            "items": {
              "$ref": "#/components/schemas/AccountSummary"
            },
            "type": "array"
          },
          "device_id": {
            "format": "uuid",
            "type": "string"
          },
          "keyset": {
            "$ref": "#/components/schemas/KeysetDocument"
          },
          "session": {
            "$ref": "#/components/schemas/SessionGrant"
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "session",
          "user_id",
          "account_id",
          "device_id",
          "keyset",
          "accounts"
        ],
        "type": "object"
      },
      "UpdateEnvironment": {
        "properties": {
          "name": {
            "type": [
              "string",
              "null"
            ]
          },
          "position": {
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "protected": {
            "type": [
              "boolean",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "UpdateIdentity": {
        "properties": {
          "description": {
            "type": [
              "string",
              "null"
            ]
          },
          "disabled": {
            "type": [
              "boolean",
              "null"
            ]
          },
          "name": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "UpdateProject": {
        "properties": {
          "name": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "UpdateSecret": {
        "properties": {
          "folder_id": {
            "description": "`Some(None)` moves the secret to the environment root.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "meta_ct": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/B64"
              },
              {
                "type": "null"
              }
            ]
          }
        },
        "type": "object"
      },
      "UpdateToken": {
        "description": "`PATCH /v1/secrets/identities/{id}/tokens/{tid}`: brings a token's expiry forward, for example\nto end the overlap after a rotation. An expiry can only move earlier.",
        "properties": {
          "expires_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "expires_at"
        ],
        "type": "object"
      },
      "UpdateVault": {
        "description": "`PATCH /v1/vaults/{id}` body.",
        "properties": {
          "attrs_ct": {
            "description": "New attributes, encrypted under the current vault key.",
            "format": "byte",
            "type": "string"
          }
        },
        "required": [
          "attrs_ct"
        ],
        "type": "object"
      },
      "UpdateWebhook": {
        "properties": {
          "active": {
            "description": "`true` turns a webhook back on and resets its failure count.",
            "type": [
              "boolean",
              "null"
            ]
          },
          "description": {
            "description": "Absent leaves the description as it is. `null` clears it.",
            "type": [
              "string",
              "null"
            ]
          },
          "event_types": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "url": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "UsageResponse": {
        "description": "Usage this period.",
        "properties": {
          "period_start": {
            "description": "First day of the period, `YYYY-MM-DD`.",
            "type": "string"
          },
          "secret_ops": {
            "format": "int64",
            "type": "integer"
          },
          "secret_ops_included": {
            "description": "Included each month. `null` is no limit.",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "secret_ops_overage": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "period_start",
          "secret_ops",
          "secret_ops_overage"
        ],
        "type": "object"
      },
      "VaultGrantIn": {
        "additionalProperties": false,
        "description": "A vault grant sealed to a member at confirmation.",
        "properties": {
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "permissions": {
            "format": "int32",
            "type": "integer"
          },
          "vault_id": {
            "format": "uuid",
            "type": "string"
          },
          "vault_key_wrapped": {
            "description": "The vault key sealed (`0x11`) to the member's keyset `enc` key.",
            "format": "byte",
            "type": "string"
          }
        },
        "required": [
          "vault_id",
          "permissions",
          "key_version",
          "vault_key_wrapped"
        ],
        "type": "object"
      },
      "VaultHead": {
        "description": "Vault metadata carried on every changes page.",
        "properties": {
          "attrs_ct": {
            "format": "byte",
            "type": "string"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "attrs_ct",
          "key_version"
        ],
        "type": "object"
      },
      "VaultList": {
        "description": "Vault list (API.md §3.1.1).",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/VaultSummary"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "VaultSummary": {
        "description": "One entry of `GET /v1/vaults` (API.md §3.1.1).",
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "attrs_ct": {
            "format": "byte",
            "type": "string"
          },
          "granted_by": {
            "description": "Who sealed `vault_key_wrapped`. Members of a shared vault check that person's signature\nbefore they trust the key (CRYPTOGRAPHY.md §7.3).",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "key_version": {
            "format": "int32",
            "type": "integer"
          },
          "kind": {
            "type": "string"
          },
          "permissions": {
            "format": "int32",
            "type": "integer"
          },
          "revision": {
            "format": "int64",
            "type": "integer"
          },
          "vault_key_wrapped": {
            "format": "byte",
            "type": "string"
          },
          "via_group": {
            "description": "Set when the key reached the caller through a group grant: the group whose key opens it.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "account_id",
          "kind",
          "attrs_ct",
          "revision",
          "key_version",
          "vault_key_wrapped",
          "permissions"
        ],
        "type": "object"
      },
      "VerifyEmailRequest": {
        "description": "`POST /v1/sib/verify-email` and `POST /v1/sib/reset-password` share the link token.",
        "properties": {
          "token": {
            "description": "The `token` from the emailed link.",
            "type": "string"
          }
        },
        "required": [
          "token"
        ],
        "type": "object"
      },
      "VerifyPage": {
        "description": "One page of the chain for client-side verification.",
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "anchor": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/AnchorView",
                "description": "On the last page only: the anchor in the newest signed tree head."
              },
              {
                "type": "null"
              }
            ]
          },
          "checkpoints": {
            "description": "Checkpoints from `from_seq - 1` to the last event of the page.",
            "items": {
              "$ref": "#/components/schemas/CheckpointView"
            },
            "type": "array"
          },
          "events": {
            "description": "Events in sequence order.",
            "items": {
              "$ref": "#/components/schemas/AuditEventView"
            },
            "type": "array"
          },
          "head_seq": {
            "description": "The newest event in the account. Zero when there is none.",
            "format": "int64",
            "type": "integer"
          },
          "next_from_seq": {
            "description": "Ask again from here. `null` on the last page.",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "start": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/CheckpointView",
                "description": "The checkpoint at `from_seq - 1`, when the page does not start at event 1."
              },
              {
                "type": "null"
              }
            ]
          }
        },
        "required": [
          "account_id",
          "head_seq",
          "events",
          "checkpoints"
        ],
        "type": "object"
      },
      "Version": {
        "properties": {
          "environment": {
            "type": "string"
          },
          "git_sha": {
            "type": [
              "string",
              "null"
            ]
          },
          "service": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "service",
          "version",
          "environment"
        ],
        "type": "object"
      },
      "VersionIn": {
        "description": "One new version.\n\nZero-knowledge projects send `value_ct` and `dek_wrapped`, the per-version key wrapped by the\nenvironment key. Managed projects send `value` in clear over TLS, and `api` seals it under the\nproject's keys (CRYPTOGRAPHY.md §14.1). `expires_at` and `ttl_seconds` both set an expiry\n(SEC-09). Send one of them at most.",
        "properties": {
          "dek_wrapped": {
            "$ref": "#/components/schemas/B64"
          },
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "ttl_seconds": {
            "description": "Seconds from the write until the version expires.",
            "format": "int32",
            "minimum": 0,
            "type": [
              "integer",
              "null"
            ]
          },
          "value": {
            "description": "Managed projects only.",
            "type": [
              "string",
              "null"
            ]
          },
          "value_ct": {
            "$ref": "#/components/schemas/B64"
          }
        },
        "type": "object"
      },
      "VersionInfo": {
        "properties": {
          "aliases": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "created_by": {
            "type": "string"
          },
          "destroy_after": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "state": {
            "$ref": "#/components/schemas/VersionState"
          },
          "version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "version",
          "state",
          "created_by",
          "created_at",
          "aliases"
        ],
        "type": "object"
      },
      "VersionList": {
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/VersionInfo"
            },
            "type": "array"
          },
          "next_cursor": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "VersionState": {
        "description": "`enabled`, `disabled` or `destroyed`.",
        "enum": [
          "enabled",
          "disabled",
          "destroyed"
        ],
        "type": "string"
      },
      "VersionValue": {
        "description": "The value of one version. Zero-knowledge projects return it sealed. Managed projects return\n`value` in clear and leave the sealed fields empty.",
        "properties": {
          "dek_wrapped": {
            "$ref": "#/components/schemas/B64"
          },
          "env_key_version": {
            "format": "int32",
            "type": "integer"
          },
          "environment_revision": {
            "format": "int64",
            "type": "integer"
          },
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "secret_id": {
            "format": "uuid",
            "type": "string"
          },
          "value": {
            "type": [
              "string",
              "null"
            ]
          },
          "value_ct": {
            "$ref": "#/components/schemas/B64"
          },
          "version": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "secret_id",
          "version",
          "environment_revision"
        ],
        "type": "object"
      },
      "Webhook": {
        "properties": {
          "active": {
            "type": "boolean"
          },
          "consecutive_failures": {
            "format": "int32",
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "description": {
            "type": [
              "string",
              "null"
            ]
          },
          "disabled_reason": {
            "type": [
              "string",
              "null"
            ]
          },
          "event_types": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "previous_secret_expires_at": {
            "description": "After a signing secret rotation, deliveries carry a second `v1` signature made with the\nold secret until this time.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "project_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "url",
          "event_types",
          "active",
          "consecutive_failures",
          "created_at"
        ],
        "type": "object"
      },
      "WebhookDelivery": {
        "properties": {
          "attempt": {
            "format": "int32",
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "event_id": {
            "format": "uuid",
            "type": "string"
          },
          "event_type": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "next_attempt_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "response_code": {
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "status": {
            "description": "`pending`, `succeeded`, `failed` or `abandoned`.",
            "type": "string"
          }
        },
        "required": [
          "id",
          "event_id",
          "event_type",
          "attempt",
          "status",
          "created_at"
        ],
        "type": "object"
      },
      "WebhookTest": {
        "description": "The answer to `POST /v1/webhooks/{id}:test`.",
        "properties": {
          "event_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "event_id"
        ],
        "type": "object"
      }
    },
    "securitySchemes": {
      "dpop_session": {
        "description": "A Sphragis session token in `Authorization: DPoP <token>`, with a `DPoP` proof header signed by the device key (RFC 9449).",
        "scheme": "DPoP",
        "type": "http"
      },
      "sib_bearer": {
        "bearerFormat": "JWT",
        "description": "A SiliconBlast Identity access token. Used for sign-in, registration and unlock.",
        "scheme": "bearer",
        "type": "http"
      },
      "step_up": {
        "description": "A SiliconBlast access token from a sign-in in the last five minutes, for routes that need step-up (API.md §2).",
        "in": "header",
        "name": "Sphragis-Step-Up",
        "type": "apiKey"
      }
    }
  },
  "info": {
    "description": "Management API for Sphragis vaults, authenticator and secrets.",
    "license": {
      "identifier": "LicenseRef-Sphragis",
      "name": "LicenseRef-Sphragis"
    },
    "title": "Sphragis API",
    "version": "0.1.0"
  },
  "openapi": "3.1.0",
  "paths": {
    "/v1/accounts": {
      "post": {
        "operationId": "create_account",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateAccount"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountOut"
                }
              }
            },
            "description": "Created"
          },
          "409": {
            "description": "Create a vault first"
          },
          "422": {
            "description": "Invalid body"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Creates a Family or Team account with the caller as its owner.",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/accounts/{id}": {
      "get": {
        "operationId": "get_account",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountOut"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "One account the caller belongs to.",
        "tags": [
          "accounts"
        ]
      },
      "patch": {
        "operationId": "update_account",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RenameAccount"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountOut"
                }
              }
            },
            "description": "OK"
          },
          "412": {
            "description": "Stale If-Match"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Renames the account. Owners and admins only. Needs `If-Match`.",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/accounts/{id}/groups": {
      "get": {
        "operationId": "list_groups",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GroupList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Groups of the account. Every active member may list them.",
        "tags": [
          "accounts"
        ]
      },
      "post": {
        "operationId": "create_group",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateGroup"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Group"
                }
              }
            },
            "description": "Created"
          },
          "409": {
            "description": "Name taken"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Creates a group. Owners and admins only.",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/accounts/{id}/groups/{gid}": {
      "delete": {
        "operationId": "delete_group",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Group id",
            "in": "path",
            "name": "gid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Deleted"
          },
          "412": {
            "description": "Stale If-Match"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Deletes a group and its vault grants. Owners and admins only. Needs `If-Match`. A group that\nis the last manager of a vault cannot be deleted.",
        "tags": [
          "accounts"
        ]
      },
      "get": {
        "operationId": "get_group",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Group id",
            "in": "path",
            "name": "gid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GroupDetail"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "One group with its members and the vaults granted to it.",
        "tags": [
          "accounts"
        ]
      },
      "patch": {
        "operationId": "rename_group",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Group id",
            "in": "path",
            "name": "gid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RenameGroup"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Group"
                }
              }
            },
            "description": "OK"
          },
          "412": {
            "description": "Stale If-Match"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Renames a group. Owners and admins only. Needs `If-Match`.",
        "tags": [
          "accounts"
        ]
      },
      "post": {
        "operationId": "group_action",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "<group id>:rotate",
            "in": "path",
            "name": "gid",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RotateGroup"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Group"
                }
              }
            },
            "description": "OK"
          },
          "409": {
            "description": "Stale key version"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Rotates the group key (CRYPTOGRAPHY.md §11.4). Owners and admins only. The segment is\n`<group id>:rotate`.",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/accounts/{id}/groups/{gid}/members/{user}": {
      "delete": {
        "operationId": "delete_group_member",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Group id",
            "in": "path",
            "name": "gid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "User id",
            "in": "path",
            "name": "user",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GroupMemberRemoved"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Removes a member from a group and marks the group for rotation. Owners and admins only.",
        "tags": [
          "accounts"
        ]
      },
      "put": {
        "operationId": "put_group_member",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Group id",
            "in": "path",
            "name": "gid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "User id",
            "in": "path",
            "name": "user",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutGroupMember"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Group"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Adds a member to a group with the group key sealed to them. Owners and admins only.",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/accounts/{id}/invitations": {
      "get": {
        "operationId": "list_invitations",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InvitationList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Invitations that are not accepted or revoked. Owners and admins only.",
        "tags": [
          "accounts"
        ]
      },
      "post": {
        "operationId": "create_invitation",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateInvitation"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InvitationCreated"
                }
              }
            },
            "description": "Created"
          },
          "402": {
            "description": "No seats left"
          },
          "409": {
            "description": "Already a member or invited"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Invites an address. Owners and admins only. The answer carries the token once, so the admin\ncan share the link. An email job is queued without the token.",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/accounts/{id}/invitations/{invitation}": {
      "delete": {
        "operationId": "revoke_invitation",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Invitation id",
            "in": "path",
            "name": "invitation",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Revoked"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Revokes an open invitation. Owners and admins only.",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/accounts/{id}/members": {
      "get": {
        "operationId": "list_members",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "`keys` adds each member's current public bundle.",
            "in": "query",
            "name": "include",
            "required": false,
            "schema": {
              "type": [
                "string",
                "null"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MemberList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Members with role and state. Guests see only themselves.",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/accounts/{id}/members/{user}": {
      "patch": {
        "operationId": "change_role",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "User id",
            "in": "path",
            "name": "user",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ChangeRole"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Member"
                }
              }
            },
            "description": "OK"
          },
          "412": {
            "description": "Stale If-Match"
          }
        },
        "security": [
          {
            "dpop_session": [],
            "step_up": []
          }
        ],
        "summary": "Changes a member's role. Needs a fresh SIB sign-in (S+) and `If-Match`.",
        "tags": [
          "accounts"
        ]
      },
      "post": {
        "operationId": "member_action",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "<user id>:confirm, :suspend, :reactivate or :remove",
            "in": "path",
            "name": "user",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "oneOf": [
                  {
                    "$ref": "#/components/schemas/ConfirmMember"
                  },
                  {
                    "type": "null"
                  }
                ]
              }
            }
          },
          "description": "Only for :confirm"
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MemberActionOut"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "`:confirm`, `:suspend`, `:reactivate` and `:remove` on a member. axum cannot route on a\nsuffix inside a segment, so the segment arrives as `<user id>:<verb>` and is split here.\nConfirm needs a session. The others need a fresh SIB sign-in (S+).",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/accounts/{id}/policies": {
      "get": {
        "operationId": "get_policies",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Policies"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": [],
            "step_up": []
          }
        ],
        "summary": "The account's policies (S+).",
        "tags": [
          "accounts"
        ]
      },
      "put": {
        "operationId": "put_policies",
        "parameters": [
          {
            "description": "Account id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/Policies"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Policies"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": [],
            "step_up": []
          }
        ],
        "summary": "Replaces the policy document. Owners and admins only (S+). Turning on `require_2fa` needs a\nstep-up that used a second factor, so an admin cannot lock themselves out.",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/attachments/{a}": {
      "delete": {
        "operationId": "delete_attachment",
        "parameters": [
          {
            "description": "Attachment id",
            "in": "path",
            "name": "a",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Deleted"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Marks an attachment deleted. The worker removes its objects. Repeating the call answers 204.",
        "tags": [
          "attachments"
        ]
      },
      "post": {
        "operationId": "attachment_action",
        "parameters": [
          {
            "description": "<attachment id>:complete",
            "in": "path",
            "name": "a",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CompleteAttachment"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AttachmentState"
                }
              }
            },
            "description": "Ready"
          },
          "404": {
            "description": "Not found or deleted"
          },
          "422": {
            "description": "`attachment.incomplete` or an invalid body"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "`:complete` on an attachment. axum cannot route on a suffix inside a segment, so the segment\narrives as `<id>:complete` and is split here.",
        "tags": [
          "attachments"
        ]
      }
    },
    "/v1/attachments/{id}/download": {
      "get": {
        "operationId": "download_attachment",
        "parameters": [
          {
            "description": "Attachment id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AttachmentDownload"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found or deleted"
          },
          "409": {
            "description": "`attachment.not_ready`: the upload is not complete"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Presigned GET URLs (valid 5 minutes) and the wrapped file key.",
        "tags": [
          "attachments"
        ]
      }
    },
    "/v1/audit/checkpoints": {
      "get": {
        "operationId": "audit_checkpoints",
        "parameters": [
          {
            "description": "1 to 500, default 100.",
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "format": "int64",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CheckpointList"
                }
              }
            },
            "description": "OK"
          },
          "403": {
            "description": "Not an owner or admin"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Signed checkpoints of the account, the newest tree head, and the Ed25519 public keys.",
        "tags": [
          "audit"
        ]
      }
    },
    "/v1/audit/events": {
      "get": {
        "operationId": "audit_list_events",
        "parameters": [
          {
            "description": "An exact actor (`user:<id>`) or a kind (`user`, `machine`, `system`, `scim`).",
            "in": "query",
            "name": "actor",
            "required": false,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Comma-separated action names. `secret.*` matches every action starting with `secret.`.",
            "in": "query",
            "name": "action",
            "required": false,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "target_type",
            "required": false,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "target_id",
            "required": false,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "RFC 3339. Events at or after this time.",
            "in": "query",
            "name": "from",
            "required": false,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "RFC 3339. Events before this time.",
            "in": "query",
            "name": "to",
            "required": false,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "1 to 500, default 100.",
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "format": "int64",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuditEventPage"
                }
              }
            },
            "description": "OK"
          },
          "403": {
            "description": "Not an owner or admin"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Audit events of the account, newest first.",
        "tags": [
          "audit"
        ]
      }
    },
    "/v1/audit/verify": {
      "get": {
        "operationId": "audit_verify",
        "parameters": [
          {
            "description": "First event, default 1. Above 1 the page carries the checkpoint at `from_seq - 1`.",
            "in": "query",
            "name": "from_seq",
            "required": false,
            "schema": {
              "format": "int64",
              "type": "integer"
            }
          },
          {
            "description": "Last event, default the chain head.",
            "in": "query",
            "name": "to_seq",
            "required": false,
            "schema": {
              "format": "int64",
              "type": "integer"
            }
          },
          {
            "description": "Events per page, 1 to 1,000, default 500.",
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "format": "int64",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VerifyPage"
                }
              }
            },
            "description": "OK"
          },
          "403": {
            "description": "Not an owner or admin"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "A page of the chain with the checkpoints that cover it, so the client recomputes every hash.\nThe last page also carries the newest checkpoint's inclusion proof in a signed tree head.",
        "tags": [
          "audit"
        ]
      }
    },
    "/v1/billing/checkout-session": {
      "post": {
        "operationId": "billing_checkout",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CheckoutRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RedirectView"
                }
              }
            },
            "description": "Created"
          },
          "409": {
            "description": "Already subscribed"
          },
          "503": {
            "description": "Billing is off"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Starts Stripe Checkout for the account in `Sphragis-Account` (BIL-01, BIL-02).",
        "tags": [
          "billing"
        ]
      }
    },
    "/v1/billing/plans": {
      "get": {
        "operationId": "billing_plans",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlansView"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [],
        "summary": "Plans and prices for the caller's region (BIL-02). Public.",
        "tags": [
          "billing"
        ]
      }
    },
    "/v1/billing/portal-session": {
      "post": {
        "operationId": "billing_portal",
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RedirectView"
                }
              }
            },
            "description": "Created"
          },
          "404": {
            "description": "The account never checked out"
          },
          "503": {
            "description": "Billing is off"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Opens the Stripe customer portal (BIL-03).",
        "tags": [
          "billing"
        ]
      }
    },
    "/v1/billing/stripe/webhook": {
      "post": {
        "operationId": "billing_stripe_webhook",
        "requestBody": {
          "content": {
            "text/plain": {
              "schema": {
                "type": "string"
              }
            }
          },
          "description": "The Stripe event, as Stripe sent it",
          "required": true
        },
        "responses": {
          "200": {
            "description": "Processed or already seen"
          },
          "400": {
            "description": "Bad signature or payload"
          },
          "503": {
            "description": "Billing is off"
          }
        },
        "security": [],
        "summary": "Stripe events (BIL-01). Verified by `Stripe-Signature` on the raw body and processed once.",
        "tags": [
          "billing"
        ]
      }
    },
    "/v1/billing/subscription": {
      "get": {
        "operationId": "billing_subscription",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SubscriptionResponse"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Current plan, seats, status and grace (BIL-05).",
        "tags": [
          "billing"
        ]
      }
    },
    "/v1/billing/usage": {
      "get": {
        "operationId": "billing_usage",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UsageResponse"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Usage counters for the period (BIL-01).",
        "tags": [
          "billing"
        ]
      }
    },
    "/v1/devices": {
      "get": {
        "operationId": "list_devices",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeviceList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The person's devices that are not revoked.",
        "tags": [
          "devices"
        ]
      }
    },
    "/v1/devices/{id}": {
      "delete": {
        "operationId": "revoke_device",
        "parameters": [
          {
            "description": "Device id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Revokes a device and ends its sessions. Revocation is idempotent and needs no `If-Match`.",
        "tags": [
          "devices"
        ]
      },
      "patch": {
        "operationId": "rename_device",
        "parameters": [
          {
            "description": "Device id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "ETag of the device",
            "in": "header",
            "name": "If-Match",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RenameDevice"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RenamedDevice"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          },
          "412": {
            "description": "The resource changed. Fetch it again"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Renames a device. Needs `If-Match` with the ETag from the device list.",
        "tags": [
          "devices"
        ]
      }
    },
    "/v1/exports": {
      "post": {
        "operationId": "record_export",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RecordExport"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "Recorded. The client may hand the file over"
          },
          "401": {
            "description": "Step-up or master password proof required"
          },
          "422": {
            "description": "Unknown format or count out of range"
          }
        },
        "security": [
          {
            "dpop_session": [],
            "step_up": []
          }
        ],
        "summary": "Records an export in the audit chain after the step-up and master password checks.",
        "tags": [
          "items"
        ]
      }
    },
    "/v1/healthz": {
      "get": {
        "operationId": "healthz",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Health"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [],
        "summary": "Liveness. Answers as long as the process serves requests.",
        "tags": [
          "ops"
        ]
      }
    },
    "/v1/iam/role-bindings": {
      "get": {
        "operationId": "list_iam_role_bindings",
        "parameters": [
          {
            "in": "query",
            "name": "scope_type",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "scope_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Page_RoleBinding"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Bindings at one scope.",
        "tags": [
          "iam"
        ]
      },
      "post": {
        "operationId": "create_iam_role_bindings",
        "parameters": [
          {
            "description": "SIB access token from a sign-in in the last 5 minutes",
            "in": "header",
            "name": "Sphragis-Step-Up",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateRoleBinding"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RoleBinding"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "description": "Step-up or a fresh unlock required"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Grants a role. Needs a fresh SIB sign-in in `Sphragis-Step-Up` and a master password unlock in\nthe last five minutes (CRYPTOGRAPHY.md §9.3).",
        "tags": [
          "iam"
        ]
      }
    },
    "/v1/iam/role-bindings/{id}": {
      "delete": {
        "operationId": "delete_iam_role_bindings",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Removes a binding.",
        "tags": [
          "iam"
        ]
      }
    },
    "/v1/iam:testPermissions": {
      "post": {
        "operationId": "test_permissions",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TestPermissions"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TestPermissionsResult"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Which of the listed permissions the caller holds on a resource.",
        "tags": [
          "iam"
        ]
      }
    },
    "/v1/invitations/{token}": {
      "post": {
        "operationId": "accept_invitation",
        "parameters": [
          {
            "description": "<invitation token>:accept",
            "in": "path",
            "name": "token",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AcceptInvitation"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Accepted"
                }
              }
            },
            "description": "OK"
          },
          "403": {
            "description": "Signed in with another address"
          },
          "410": {
            "description": "Expired"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Accepts an invitation and publishes the invitee's keys to the account (S, plus a step-up with\na second factor when the account requires one). The segment is `<token>:accept`.",
        "tags": [
          "accounts"
        ]
      }
    },
    "/v1/item-moves": {
      "post": {
        "operationId": "move_items",
        "parameters": [
          {
            "description": "Replays return the first answer (crate::idempotency)",
            "in": "header",
            "name": "Idempotency-Key",
            "required": false,
            "schema": {
              "format": "uuid",
              "type": [
                "string",
                "null"
              ]
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MoveRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MoveResponse"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "A vault does not exist or the caller cannot see it"
          },
          "409": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MoveConflict"
                }
              }
            },
            "description": "`sync.conflict`: an item changed. Nothing was moved"
          },
          "422": {
            "description": "Invalid request"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Move or copy items to another vault in the same account. Atomic: on any stale\n`base_version` nothing changes and the answer is `409 sync.conflict` with the server copies.",
        "tags": [
          "sync"
        ]
      }
    },
    "/v1/me": {
      "get": {
        "operationId": "get_me",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Me"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "description": "Missing or invalid credentials"
          }
        },
        "security": [
          {
            "dpop_session": []
          },
          {
            "sib_bearer": []
          }
        ],
        "summary": "The signed-in person.",
        "tags": [
          "me"
        ]
      }
    },
    "/v1/me/keyset": {
      "get": {
        "operationId": "keyset",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/KeysetDocument"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "No vault yet"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The current keyset envelope and signed public bundle.",
        "tags": [
          "me"
        ]
      }
    },
    "/v1/me/keyset:prepare": {
      "post": {
        "operationId": "prepare_rotation",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RegisterStartBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RegisterStartResponse"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "OPAQUE registration response for new credentials. Stateless: the upload follows in\n`keyset:rotate`.",
        "tags": [
          "me"
        ]
      }
    },
    "/v1/me/keyset:rotate": {
      "post": {
        "operationId": "rotate_keyset",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RotateKeyset"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Rotated"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "description": "auth.step_up_required, or the password proof failed"
          },
          "409": {
            "description": "keyset.changed"
          }
        },
        "security": [
          {
            "dpop_session": [],
            "step_up": []
          }
        ],
        "summary": "Changes the master password or the Secret Key: new OPAQUE record and re-wrapped keyset in one\ncall. Needs a step-up and a fresh OPAQUE login, or a second-factor step-up for trusted-device\nrecovery.",
        "tags": [
          "me"
        ]
      }
    },
    "/v1/me/unlock-passkeys": {
      "get": {
        "operationId": "list_passkeys",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeyList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The person's unlock passkeys.",
        "tags": [
          "me"
        ]
      },
      "post": {
        "operationId": "register_passkey",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasskeyRegistration"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeyInfo"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "description": "The credential did not verify"
          },
          "409": {
            "description": "limit.reached"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Adds an unlock passkey with its PRF-wrapped AUK.",
        "tags": [
          "me"
        ]
      }
    },
    "/v1/me/unlock-passkeys/options": {
      "post": {
        "operationId": "passkey_registration_options",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeyCreationOptions"
                }
              }
            },
            "description": "OK"
          },
          "409": {
            "description": "limit.reached"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Creation options for a new unlock passkey (RP ID `sphragis.siliconblast.com`).",
        "tags": [
          "me"
        ]
      }
    },
    "/v1/me/unlock-passkeys/{id}": {
      "delete": {
        "operationId": "remove_passkey",
        "parameters": [
          {
            "description": "Passkey id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Removed"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Removes an unlock passkey and deletes its envelope.",
        "tags": [
          "me"
        ]
      }
    },
    "/v1/public/share-links/{id}": {
      "get": {
        "operationId": "open_public_share_links",
        "parameters": [
          {
            "description": "Share link id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Access token derived from the link key, base64url",
            "in": "header",
            "name": "Share-Auth",
            "required": false,
            "schema": {
              "type": [
                "string",
                "null"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PublicShareLink"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "description": "`share.auth_invalid`"
          },
          "404": {
            "description": "Unknown, expired, used up or revoked"
          },
          "429": {
            "description": "Too many requests from this address"
          }
        },
        "security": [],
        "summary": "Opens a share link. Without `Share-Auth` it returns the expiry and the passphrase salt and\ncounts nothing. With a valid `Share-Auth` it returns the ciphertext and counts one view. A\nwrong token answers `401 share.auth_invalid` and counts nothing. Unknown, expired, used up and\nrevoked links all answer `404`.",
        "tags": [
          "sharing"
        ]
      }
    },
    "/v1/readyz": {
      "get": {
        "operationId": "readyz",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Ready"
                }
              }
            },
            "description": "OK"
          },
          "503": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Ready"
                }
              }
            },
            "description": "Not ready"
          }
        },
        "security": [],
        "summary": "Readiness. Fly routes traffic only to machines whose database and Redis answer.",
        "tags": [
          "ops"
        ]
      }
    },
    "/v1/recovery/codes": {
      "get": {
        "operationId": "list_codes",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecoveryCodeList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The person's unused recovery codes. The codes themselves are never stored.",
        "tags": [
          "me"
        ]
      },
      "post": {
        "operationId": "replace_recovery_codes",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ReplaceCodes"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecoveryCodeList"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "description": "auth.step_up_required"
          },
          "409": {
            "description": "keyset.changed"
          }
        },
        "security": [
          {
            "dpop_session": [],
            "step_up": []
          }
        ],
        "summary": "Replaces the recovery codes. The client wraps the keyset under each new code.",
        "tags": [
          "me"
        ]
      }
    },
    "/v1/recovery/finish": {
      "post": {
        "operationId": "recovery_finish",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RecoveryFinish"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Recovered"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "description": "The recovery expired or the code was used"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "Recovery with a code, step two: new master password, new code, trusted device and a session.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/recovery/start": {
      "post": {
        "operationId": "recovery_start",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RecoveryStart"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecoveryChallenge"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "description": "The code is wrong or used"
          },
          "429": {
            "description": "Too many attempts"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "Recovery with a code, step one: proves the code and returns the recovery copy of the keyset.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/register/finish": {
      "post": {
        "operationId": "register_finish",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RegisterFinish"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Registered"
                }
              }
            },
            "description": "Created"
          },
          "409": {
            "description": "The account already has a vault"
          },
          "422": {
            "description": "A field is invalid"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "OPAQUE registration upload, KDF parameters, keyset and the first device.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/register/start": {
      "post": {
        "operationId": "register_start",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RegisterStartBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RegisterStartResponse"
                }
              }
            },
            "description": "OK"
          },
          "409": {
            "description": "The account already has a vault"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "OPAQUE registration, first message.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/secrets/environments/{e}": {
      "delete": {
        "operationId": "delete_environment",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Deletes an environment with its secrets.",
        "tags": [
          "secrets"
        ]
      },
      "patch": {
        "operationId": "update_environment",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateEnvironment"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Environment"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Renames, protects or reorders an environment.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "rollback_environment",
        "parameters": [
          {
            "description": "<environment>:rollback",
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/Rollback"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RollbackResult"
                }
              }
            },
            "description": "OK"
          },
          "409": {
            "description": "A needed version is destroyed or another write came first"
          },
          "422": {
            "description": "The sealed versions do not match the plan"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "`:rollback` on an environment. axum cannot route on a suffix inside a segment, so the segment\narrives as `<environment>:rollback` and is split here.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/environments/{e}/folders": {
      "get": {
        "operationId": "list_folders",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Page_Folder"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "An environment's folders.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "create_folder",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateFolder"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Folder"
                }
              }
            },
            "description": "Created"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Creates a folder.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/environments/{e}/folders/{f}": {
      "delete": {
        "operationId": "delete_folder",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "f",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Deletes a folder. Its secrets move to the environment root, and subfolders are removed.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/environments/{e}/key-grants/{type}/{id}": {
      "delete": {
        "operationId": "delete_grant",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "type",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Removes every grant of the environment key to a principal. A holder may still have the key in\nmemory, so the console recommends a rekey afterwards (CRYPTOGRAPHY.md §13.4).",
        "tags": [
          "secrets"
        ]
      },
      "get": {
        "operationId": "get_grant",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "type",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/KeyGrant"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The newest grant of an environment key to one principal. Callers read their own grant. Admins\nwith key management may read any.",
        "tags": [
          "secrets"
        ]
      },
      "put": {
        "operationId": "put_grant",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "type",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutGrant"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/KeyGrant"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Seals the environment key to a principal (shares the environment).",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/environments/{e}/secrets": {
      "get": {
        "operationId": "list_secrets_environments_secrets",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "format": "int64",
              "type": [
                "integer",
                "null"
              ]
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "type": [
                "string",
                "null"
              ]
            }
          },
          {
            "description": "Include soft-deleted secrets.",
            "in": "query",
            "name": "deleted",
            "required": false,
            "schema": {
              "type": [
                "boolean",
                "null"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecretList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Secrets in an environment. Zero-knowledge projects return lookup HMACs and encrypted metadata.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "create_secrets_environments_secrets",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateSecret"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Secret"
                }
              }
            },
            "description": "Created"
          },
          "402": {
            "description": "Plan limit reached"
          },
          "409": {
            "description": "Conflict"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Creates a secret with its first version.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/environments/{e}/secrets:batchWrite": {
      "post": {
        "operationId": "batch_write",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BatchWrite"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BatchWriteResult"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Upserts many secrets in one revision (dotenv import).",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/environments/{e}/snapshot": {
      "get": {
        "operationId": "get_environment_snapshot",
        "parameters": [
          {
            "in": "path",
            "name": "e",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "RFC 3339 time. Default: now.",
            "in": "query",
            "name": "at",
            "required": false,
            "schema": {
              "type": [
                "string",
                "null"
              ]
            }
          },
          {
            "description": "Include each version's sealed value (Zero-knowledge only). Needs `secrets.versions.access`.",
            "in": "query",
            "name": "include_values",
            "required": false,
            "schema": {
              "type": [
                "boolean",
                "null"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Snapshot"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "An environment as it stood at a point in time.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/identities": {
      "get": {
        "operationId": "list_secrets_identities",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Page_Identity"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Machine identities in the account.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "create_secrets_identities",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateIdentity"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Identity"
                }
              }
            },
            "description": "Created"
          },
          "402": {
            "description": "Plan limit reached"
          },
          "409": {
            "description": "Conflict"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Creates a machine identity from the public key the admin's client generated.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/identities/{id}": {
      "delete": {
        "operationId": "delete_secrets_identities",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Deletes an identity, its tokens, grants and bindings.",
        "tags": [
          "secrets"
        ]
      },
      "get": {
        "operationId": "get_secrets_identities",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Identity"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "One identity.",
        "tags": [
          "secrets"
        ]
      },
      "patch": {
        "operationId": "update_secrets_identities",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateIdentity"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Identity"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Renames, describes, disables or enables an identity. A disabled identity's tokens stop working\nat once.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/identities/{id}/escrow": {
      "get": {
        "operationId": "status",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EscrowStatus"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Who holds the identity's seed and who may. The client checks each candidate's keys and\ngrants itself before it seals a copy.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/identities/{id}/escrow/me": {
      "get": {
        "operationId": "mine",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EscrowEntry"
                }
              }
            },
            "description": "OK"
          },
          "403": {
            "description": "Not a holder"
          },
          "404": {
            "description": "No copy for you"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The caller's own sealed copy, after checking again that the caller is a holder.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/identities/{id}/escrow/{user}": {
      "delete": {
        "operationId": "remove",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "user",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Removed"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Removes a person's copies. A token manager may remove anyone's, and a person their own.",
        "tags": [
          "secrets"
        ]
      },
      "put": {
        "operationId": "put",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "user",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutEscrow"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "Stored"
          },
          "403": {
            "description": "Not a holder"
          },
          "422": {
            "description": "The person cannot hold this identity's key"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Stores a copy of the seed sealed to `user`. The caller must be a holder, or the identity has\nno copies yet (its creation, or the first escrow of an older identity). Both people must meet\nthe holder rule.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/identities/{id}/oidc-trust": {
      "get": {
        "operationId": "list_oidc_trust",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Page_OidcTrustPolicy"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "An identity's trust policies.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "create_oidc_trust",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/OidcTrustPolicyIn"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OidcTrustPolicy"
                }
              }
            },
            "description": "Created"
          },
          "422": {
            "description": "Invalid policy"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Adds a trust policy.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/identities/{id}/oidc-trust/{pid}": {
      "delete": {
        "operationId": "delete_oidc_trust",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "pid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Removes a trust policy. Access tokens it issued stop working at once.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/identities/{id}/tokens": {
      "get": {
        "operationId": "list_tokens",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Page_TokenInfo"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "An identity's tokens. Hashes and wrapped keys are never returned.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "issue_token",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "SIB access token from a sign-in in the last 5 minutes",
            "in": "header",
            "name": "Sphragis-Step-Up",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/IssueToken"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenInfo"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "description": "Step-up or a fresh unlock required"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Registers a token the admin's client generated. Only `auth_hash` and the wrapped identity seed\nreach the server. Needs a fresh SIB sign-in in `Sphragis-Step-Up` and a master password unlock\nin the last five minutes (CRYPTOGRAPHY.md §9.3).",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/identities/{id}/tokens/{tid}": {
      "delete": {
        "operationId": "revoke_token",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "tid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Revokes a token. New reads with it fail at once.",
        "tags": [
          "secrets"
        ]
      },
      "patch": {
        "operationId": "update_token",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "tid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateToken"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenInfo"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Brings a token's expiry forward, which ends the overlap after a rotation. An expiry never\nmoves later, and a time in the past is refused (revoke the token instead).",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/projects": {
      "get": {
        "operationId": "list_secrets_projects",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Page_Project"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Projects the caller can see.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "create_secrets_projects",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateProject"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Project"
                }
              }
            },
            "description": "Created"
          },
          "402": {
            "description": "Plan limit"
          },
          "409": {
            "description": "Slug or id in use"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Creates a project. Zero-knowledge is the default mode. Managed projects need `keyd` and a plan\nthat includes Managed mode.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/projects/{p}": {
      "delete": {
        "operationId": "delete_secrets_projects",
        "parameters": [
          {
            "in": "path",
            "name": "p",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Soft-deletes a project. Its environments and secrets become unreachable at once.",
        "tags": [
          "secrets"
        ]
      },
      "get": {
        "operationId": "get_secrets_projects",
        "parameters": [
          {
            "in": "path",
            "name": "p",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Project"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "One project.",
        "tags": [
          "secrets"
        ]
      },
      "patch": {
        "operationId": "update_secrets_projects",
        "parameters": [
          {
            "in": "path",
            "name": "p",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateProject"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Project"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Renames a project.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/projects/{p}/environments": {
      "get": {
        "operationId": "list_environments",
        "parameters": [
          {
            "in": "path",
            "name": "p",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Page_Environment"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "A project's environments.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "create_environment",
        "parameters": [
          {
            "in": "path",
            "name": "p",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateEnvironment"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Environment"
                }
              }
            },
            "description": "Created"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Creates an environment. In Zero-knowledge projects the request carries the creator's own\nkey grant, because only clients ever hold environment keys.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/secrets/{s}": {
      "delete": {
        "operationId": "delete_secrets_secrets",
        "parameters": [
          {
            "in": "path",
            "name": "s",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Soft-deletes a secret. It can be recovered for 30 days.",
        "tags": [
          "secrets"
        ]
      },
      "get": {
        "operationId": "get_secrets_secrets",
        "parameters": [
          {
            "in": "path",
            "name": "s",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Secret"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "A secret's metadata.",
        "tags": [
          "secrets"
        ]
      },
      "patch": {
        "operationId": "update_secrets_secrets",
        "parameters": [
          {
            "in": "path",
            "name": "s",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateSecret"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Secret"
                }
              }
            },
            "description": "OK"
          },
          "412": {
            "description": "The resource changed. Fetch it again"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Updates encrypted metadata or moves the secret to another folder.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "secret_action",
        "parameters": [
          {
            "description": "<secret id>:recover",
            "in": "path",
            "name": "s",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Secret"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "`:recover` on a secret. axum cannot route on a suffix inside a segment, so the segment\narrives as `<id>:recover` and is split here.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/secrets/{s}/aliases/{alias}": {
      "delete": {
        "operationId": "delete_alias",
        "parameters": [
          {
            "in": "path",
            "name": "s",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "alias",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Removes an alias.",
        "tags": [
          "secrets"
        ]
      },
      "put": {
        "operationId": "put_alias",
        "parameters": [
          {
            "in": "path",
            "name": "s",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "alias",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetAlias"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Points an alias at a version.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/secrets/{s}/versions": {
      "get": {
        "operationId": "list_versions_secrets_secrets_versions",
        "parameters": [
          {
            "in": "path",
            "name": "s",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/VersionInfo"
                  },
                  "type": "array"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "A secret's versions, newest first.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "add_version",
        "parameters": [
          {
            "in": "path",
            "name": "s",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/VersionIn"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CreatedVersion"
                }
              }
            },
            "description": "Created"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Adds a version. Versions are immutable once written.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/secrets/secrets/{s}/versions/{v}": {
      "get": {
        "operationId": "get_version_secrets_secrets_versions",
        "parameters": [
          {
            "in": "path",
            "name": "s",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "A number, an alias or latest",
            "in": "path",
            "name": "v",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VersionValue"
                }
              }
            },
            "description": "OK"
          },
          "409": {
            "description": "Conflict"
          },
          "410": {
            "description": "Gone"
          },
          "422": {
            "description": "A Managed project. Read the value from secrets-api"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The sealed value of a version, for a person. Every read is audited. Managed projects answer\n`422 secrets.managed_values_hidden`: people read those values from `secrets-api`.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "version_action",
        "parameters": [
          {
            "in": "path",
            "name": "s",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "<version>:disable, :enable, :destroy or :cancelDestroy",
            "in": "path",
            "name": "v",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "oneOf": [
                  {
                    "$ref": "#/components/schemas/DestroyVersion"
                  },
                  {
                    "type": "null"
                  }
                ]
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VersionInfo"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "`:disable`, `:enable`, `:destroy` and `:cancelDestroy` on a version. axum cannot route on a\nsuffix inside a segment, so `{v}` arrives as `7:disable` and is split here.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/sessions": {
      "get": {
        "operationId": "list_sessions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SessionList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The person's live sessions.",
        "tags": [
          "devices"
        ]
      }
    },
    "/v1/sessions/current/lock": {
      "post": {
        "operationId": "lock",
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Ends the current session when the client locks (ACC-08).",
        "tags": [
          "devices"
        ]
      }
    },
    "/v1/sessions/current/reauth": {
      "post": {
        "operationId": "reauth",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LoginProof"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No content"
          },
          "401": {
            "description": "The login did not verify"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Marks the current session as freshly unlocked for five minutes after a fresh OPAQUE login.",
        "tags": [
          "devices"
        ]
      }
    },
    "/v1/sessions/{id}": {
      "delete": {
        "operationId": "revoke_session",
        "parameters": [
          {
            "description": "Session id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Ends one session.",
        "tags": [
          "devices"
        ]
      }
    },
    "/v1/sessions:revokeAll": {
      "post": {
        "operationId": "revoke_all",
        "parameters": [
          {
            "description": "SIB access token from a sign-in in the last 5 minutes",
            "in": "header",
            "name": "Sphragis-Step-Up",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RevokedAll"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "description": "Step-up required"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Signs the person out everywhere, the current session included (ACC-11). Needs a fresh SIB\nsign-in in `Sphragis-Step-Up`.",
        "tags": [
          "devices"
        ]
      }
    },
    "/v1/share-links": {
      "get": {
        "operationId": "list",
        "parameters": [
          {
            "description": "The item whose links to list.",
            "in": "query",
            "name": "item_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ShareLinkList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Links for one item, newest first. Needs share on the item's vault.",
        "tags": [
          "sharing"
        ]
      },
      "post": {
        "operationId": "create",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateShareLink"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ShareLink"
                }
              }
            },
            "description": "Created"
          },
          "403": {
            "description": "Missing share or reveal"
          },
          "409": {
            "description": "The id is taken"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Stores a new link for an item. Needs share and reveal on the item's vault.",
        "tags": [
          "sharing"
        ]
      }
    },
    "/v1/share-links/{id}": {
      "delete": {
        "operationId": "revoke",
        "parameters": [
          {
            "description": "Share link id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Revoked"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Revokes a link and deletes its ciphertext. Needs share on the item's vault.",
        "tags": [
          "sharing"
        ]
      }
    },
    "/v1/sib/device/approve": {
      "post": {
        "operationId": "sib_device_approve",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeviceCodeRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeviceCodeResponse"
                }
              }
            },
            "description": "Approved"
          },
          "401": {
            "description": "No valid SiliconBlast access token (`sib.unauthorized`)"
          },
          "403": {
            "description": "The code belongs to another product (`sib.device_code_other_product`)"
          },
          "404": {
            "description": "The code is invalid or expired (`sib.device_code_invalid`)"
          },
          "409": {
            "description": "The code was already approved or denied (`sib.device_code_used`)"
          },
          "503": {
            "description": "SiliconBlast is not reachable"
          }
        },
        "security": [],
        "summary": "Approves a CLI sign-in code (SBI `/device/approve`). The CLI's next poll gets tokens.",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/sib/device/deny": {
      "post": {
        "operationId": "sib_device_deny",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeviceCodeRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeviceCodeResponse"
                }
              }
            },
            "description": "Denied"
          },
          "401": {
            "description": "No valid SiliconBlast access token (`sib.unauthorized`)"
          },
          "403": {
            "description": "The code belongs to another product (`sib.device_code_other_product`)"
          },
          "404": {
            "description": "The code is invalid or expired (`sib.device_code_invalid`)"
          },
          "409": {
            "description": "The code was already approved or denied (`sib.device_code_used`)"
          },
          "503": {
            "description": "SiliconBlast is not reachable"
          }
        },
        "security": [],
        "summary": "Denies a CLI sign-in code (SBI `/device/deny`). The CLI's next poll gets `access_denied`.",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/sib/device/lookup": {
      "post": {
        "operationId": "sib_device_lookup",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeviceCodeRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeviceCodeResponse"
                }
              }
            },
            "description": "The product and scope the code asks for"
          },
          "401": {
            "description": "No valid SiliconBlast access token (`sib.unauthorized`)"
          },
          "403": {
            "description": "The code belongs to another product (`sib.device_code_other_product`)"
          },
          "404": {
            "description": "The code is invalid or expired (`sib.device_code_invalid`)"
          },
          "503": {
            "description": "SiliconBlast is not reachable"
          }
        },
        "security": [],
        "summary": "Shows what a CLI sign-in code asks for (SBI `/device/lookup`). The signed-in person's SBI\naccess token goes in `Authorization: Bearer`.",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/sib/forgot-password": {
      "post": {
        "operationId": "forgot_password",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ForgotPasswordRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "Accepted"
          },
          "503": {
            "description": "SiliconBlast is not reachable"
          }
        },
        "security": [],
        "summary": "Asks SBI to email a reset link (SBI `/api/auth/forgot-password`). Always 204, so the answer\nreveals nothing about the address.",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/sib/login": {
      "post": {
        "operationId": "sib_login",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LoginRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SibAuthResponse"
                }
              }
            },
            "description": "Tokens, or `mfa_required` with an `mfa_token`"
          },
          "401": {
            "description": "Wrong email or password (`sib.unauthorized`)"
          },
          "403": {
            "description": "The email is not verified yet (`sib.email_unverified`)"
          },
          "429": {
            "description": "Too many attempts, or SiliconBlast locked the account (`sib.locked`)"
          },
          "503": {
            "description": "SiliconBlast is not reachable"
          }
        },
        "security": [],
        "summary": "Headless sign-in with the SiliconBlast email and password (SBI `/api/auth/login`).",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/sib/mfa": {
      "post": {
        "operationId": "sib_mfa",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MfaRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SibAuthResponse"
                }
              }
            },
            "description": "Tokens"
          },
          "401": {
            "description": "Wrong code, or the `mfa_token` expired (`sib.unauthorized`)"
          },
          "503": {
            "description": "SiliconBlast is not reachable"
          }
        },
        "security": [],
        "summary": "Finishes a sign-in that answered `mfa_required` (SBI `/api/auth/mfa`).",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/sib/register": {
      "post": {
        "operationId": "sib_register",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RegisterRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SibAuthResponse"
                }
              }
            },
            "description": "`verification_required`, or tokens for an account that is already verified"
          },
          "400": {
            "description": "SiliconBlast refused the email or password (`sib.invalid_request`)"
          },
          "409": {
            "description": "An account with this email exists (`sib.account_exists`)"
          },
          "503": {
            "description": "SiliconBlast is not reachable"
          }
        },
        "security": [],
        "summary": "Creates a SiliconBlast account (SBI `/api/auth/register`). A new signup answers\n`verification_required` and no tokens.",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/sib/reset-password": {
      "post": {
        "operationId": "reset_password",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ResetPasswordRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "Password changed"
          },
          "400": {
            "description": "The link is unknown, used or expired, or SiliconBlast refused the password (`sib.invalid_request`)"
          },
          "503": {
            "description": "SiliconBlast is not reachable"
          }
        },
        "security": [],
        "summary": "Sets a new SiliconBlast password from the emailed link (SBI `/api/auth/reset-password`).\nSBI also marks the email verified and signs out every session.",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/sib/revoke": {
      "post": {
        "operationId": "sib_revoke",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RevokeRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "Signed out"
          },
          "403": {
            "description": "A cookie call from an origin that may not use it (`sib.origin`)"
          }
        },
        "security": [],
        "summary": "Ends the SBI refresh family (SBI `/revoke`) and clears the web cookie. Always 204. The\nbrowser then navigates to SBI's `end_session_endpoint` itself to end the SBI session.",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/sib/token": {
      "post": {
        "operationId": "sib_token",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TokenRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SibAuthResponse"
                }
              }
            },
            "description": "Tokens"
          },
          "400": {
            "description": "The code, verifier or refresh token is not valid (`sib.invalid_grant`). After a refresh, sign in again"
          },
          "403": {
            "description": "A cookie refresh from an origin that may not use it (`sib.origin`)"
          },
          "503": {
            "description": "SiliconBlast is not reachable"
          }
        },
        "security": [],
        "summary": "Exchanges a redirect sign-in code with its PKCE verifier, or refreshes (SBI `/token`).",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/sib/verify-email": {
      "post": {
        "operationId": "verify_email",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/VerifyEmailRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "Verified"
          },
          "400": {
            "description": "The link is unknown, used or expired (`sib.invalid_request`)"
          },
          "503": {
            "description": "SiliconBlast is not reachable"
          }
        },
        "security": [],
        "summary": "Verifies the email from the emailed link (SBI `/api/auth/verify-email`). The person then\nsigns in as usual.",
        "tags": [
          "sib"
        ]
      }
    },
    "/v1/time": {
      "get": {
        "operationId": "time",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerTime"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [],
        "summary": "The server's clock, so clients that cannot reach NTP can check theirs before showing one-time\ncodes (OTP-13). Like every answer it carries `Cache-Control: no-store`.",
        "tags": [
          "ops"
        ]
      }
    },
    "/v1/unlock/device": {
      "post": {
        "operationId": "device_unlock",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeviceUnlock"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeviceUnlocked"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "description": "Challenge or signature failed"
          },
          "403": {
            "description": "auth.full_unlock_required, auth.device_not_trusted or auth.device_revoked"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "Biometric or trusted-device unlock: the device key signs the challenge and the server issues a\nsession without OPAQUE. The keyset stays on the device under its Device Unlock Key.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/unlock/device/challenge": {
      "post": {
        "operationId": "device_challenge",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeviceChallengeRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeviceChallenge"
                }
              }
            },
            "description": "OK"
          },
          "403": {
            "description": "Device revoked or not trusted"
          },
          "429": {
            "description": "Too many unlock attempts"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "A one-time challenge for device unlock, bound to the device key that signed the proof.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/unlock/finish": {
      "post": {
        "operationId": "unlock_finish",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UnlockFinish"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Unlocked"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "description": "Unlock failed"
          },
          "429": {
            "description": "Too many unlock attempts"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "OPAQUE login, final message. Returns a session bound to the device key, the keyset and the\nperson's accounts.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/unlock/params": {
      "get": {
        "operationId": "params",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UnlockParams"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "description": "Missing or invalid SIB token"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "Parameters for 2SKD and whether the person already has a vault.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/unlock/passkey/finish": {
      "post": {
        "operationId": "passkey_unlock_finish",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasskeyUnlock"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeyUnlocked"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "description": "The assertion did not verify"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "Verifies the assertion and returns a session and the PRF-wrapped AUK.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/unlock/passkey/options": {
      "post": {
        "operationId": "passkey_unlock_options",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeyRequestOptions"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "WebAuthn request options with the PRF salt of each unlock passkey.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/unlock/start": {
      "post": {
        "operationId": "unlock_start",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UnlockStart"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UnlockChallenge"
                }
              }
            },
            "description": "OK"
          },
          "429": {
            "description": "Too many unlock attempts"
          }
        },
        "security": [
          {
            "sib_bearer": []
          }
        ],
        "summary": "OPAQUE login, first message. Registers a new device, untrusted until `finish` succeeds.",
        "tags": [
          "unlock"
        ]
      }
    },
    "/v1/users/{id}/public-keys": {
      "get": {
        "operationId": "public_keys",
        "parameters": [
          {
            "description": "User id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "The account both people belong to",
            "in": "header",
            "name": "Sphragis-Account",
            "required": false,
            "schema": {
              "format": "uuid",
              "type": [
                "string",
                "null"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PublicKeys"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "No such person in the caller's accounts"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The public keys of the caller or of someone who shares an account with them. Clients verify\nthe self-signature and pin the first bundle they see (TOFU) before sealing anything to it.",
        "tags": [
          "sharing"
        ]
      }
    },
    "/v1/vaults": {
      "get": {
        "operationId": "list_vaults",
        "parameters": [
          {
            "description": "Limit to one account",
            "in": "header",
            "name": "Sphragis-Account",
            "required": false,
            "schema": {
              "format": "uuid",
              "type": [
                "string",
                "null"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VaultList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Vaults the caller can see, across their accounts or in the `Sphragis-Account` one.",
        "tags": [
          "vaults"
        ]
      },
      "post": {
        "operationId": "create_vault",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateVault"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VaultSummary"
                }
              }
            },
            "description": "Created"
          },
          "409": {
            "description": "The id is taken"
          },
          "422": {
            "description": "Invalid body"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Creates a vault and gives the creator every permission (API.md §3.1.1).",
        "tags": [
          "vaults"
        ]
      }
    },
    "/v1/vaults/{id}": {
      "delete": {
        "operationId": "delete_vault",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Deleted"
          },
          "412": {
            "description": "Stale If-Match"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Deletes a vault. Needs `If-Match` with the vault revision.",
        "tags": [
          "vaults"
        ]
      },
      "get": {
        "operationId": "get_vault",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VaultSummary"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "One vault.",
        "tags": [
          "vaults"
        ]
      },
      "patch": {
        "operationId": "update_vault",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateVault"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VaultSummary"
                }
              }
            },
            "description": "OK"
          },
          "412": {
            "description": "Stale If-Match"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Replaces the encrypted attributes. Needs `If-Match` with the vault revision.",
        "tags": [
          "vaults"
        ]
      },
      "post": {
        "operationId": "vault_action",
        "parameters": [
          {
            "description": "<vault id>:rekey",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RekeyVault"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VaultSummary"
                }
              }
            },
            "description": "The vault after rotation"
          },
          "409": {
            "description": "`vault.rekey_stale`: the vault changed, sync and try again"
          },
          "422": {
            "description": "Invalid body"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Actions on one vault. axum cannot route on a suffix inside a segment, so the segment arrives\nas `<vault id>:<verb>` and is split here. The only verb is `rekey`.",
        "tags": [
          "sharing"
        ]
      }
    },
    "/v1/vaults/{id}/access": {
      "get": {
        "operationId": "list_access",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GrantList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Grants on a vault. Needs share or manage.",
        "tags": [
          "vaults"
        ]
      }
    },
    "/v1/vaults/{id}/access/{principal_type}/{principal_id}": {
      "delete": {
        "operationId": "delete_access",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "`user` or `group`",
            "in": "path",
            "name": "principal_type",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "User or group id",
            "in": "path",
            "name": "principal_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Revoked"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Revokes access. The last principal with manage cannot be removed.",
        "tags": [
          "vaults"
        ]
      },
      "put": {
        "operationId": "put_access",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "`user` or `group`",
            "in": "path",
            "name": "principal_type",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "User or group id",
            "in": "path",
            "name": "principal_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutGrant"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Grant"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Grants or changes access. The caller cannot grant a permission they lack.",
        "tags": [
          "vaults"
        ]
      }
    },
    "/v1/vaults/{id}/attachments": {
      "post": {
        "operationId": "declare_attachment",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Replays return the first answer",
            "in": "header",
            "name": "Idempotency-Key",
            "required": false,
            "schema": {
              "format": "uuid",
              "type": [
                "string",
                "null"
              ]
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeclareAttachment"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeclaredAttachment"
                }
              }
            },
            "description": "Declared"
          },
          "402": {
            "description": "`quota.exceeded`"
          },
          "404": {
            "description": "The item is not in this vault"
          },
          "409": {
            "description": "`attachment.id_taken`"
          },
          "422": {
            "description": "Invalid body"
          },
          "503": {
            "description": "File storage is not configured"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Declares an upload and returns one presigned PUT URL per chunk, valid for 15 minutes.",
        "tags": [
          "attachments"
        ]
      }
    },
    "/v1/vaults/{id}/changes": {
      "get": {
        "operationId": "changes",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Last revision the client applied. 0 pulls everything.",
            "in": "query",
            "name": "since",
            "required": false,
            "schema": {
              "format": "int64",
              "type": "integer"
            }
          },
          {
            "description": "Rows per page, 1 to 500. Default 100.",
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "format": "int64",
              "type": [
                "integer",
                "null"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChangesPage"
                }
              }
            },
            "description": "OK"
          },
          "410": {
            "description": "`sync.resync_required`: pull again with since=0"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Delta pull (API.md §5.1).",
        "tags": [
          "sync"
        ]
      }
    },
    "/v1/vaults/{id}/items/{item}": {
      "get": {
        "operationId": "get_item",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Item id",
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ItemEnvelope"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "One item envelope. `ETag` is the item version.",
        "tags": [
          "items"
        ]
      }
    },
    "/v1/vaults/{id}/items/{item}/versions": {
      "get": {
        "operationId": "list_versions_vaults_items_versions",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Item id",
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VersionList"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Version history, newest first (VLT-06).",
        "tags": [
          "items"
        ]
      }
    },
    "/v1/vaults/{id}/items/{item}/versions/{n}": {
      "get": {
        "operationId": "get_version_vaults_items_versions",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Item id",
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Version number",
            "in": "path",
            "name": "n",
            "required": true,
            "schema": {
              "format": "int64",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ItemEnvelope"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "One historical version as an envelope sealed for that version.",
        "tags": [
          "items"
        ]
      }
    },
    "/v1/vaults/{id}/mutations": {
      "post": {
        "operationId": "push",
        "parameters": [
          {
            "description": "Vault id",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Replays return the first answer (crate::idempotency)",
            "in": "header",
            "name": "Idempotency-Key",
            "required": false,
            "schema": {
              "format": "uuid",
              "type": [
                "string",
                "null"
              ]
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PushRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PushResponse"
                }
              }
            },
            "description": "OK"
          },
          "409": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PushResponse"
                }
              }
            },
            "description": "`sync.conflict` with `applied`, `new_revision` and `conflicts`"
          },
          "422": {
            "description": "Invalid batch"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Batch push (API.md §5.2).",
        "tags": [
          "sync"
        ]
      }
    },
    "/v1/version": {
      "get": {
        "operationId": "version",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Version"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [],
        "summary": "The running build: version, commit and environment.",
        "tags": [
          "ops"
        ]
      }
    },
    "/v1/watchtower/directories": {
      "get": {
        "operationId": "watchtower_directories",
        "parameters": [
          {
            "description": "ETag of a cached copy",
            "in": "header",
            "name": "If-None-Match",
            "required": false,
            "schema": {
              "type": [
                "string",
                "null"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            },
            "description": "OK"
          },
          "304": {
            "description": "The cached copy is current"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The 2FA and passkey directories that clients match saved websites against on the device.\nSources and licences are inside the document. Send `If-None-Match` to skip an unchanged copy.",
        "tags": [
          "watchtower"
        ]
      }
    },
    "/v1/watchtower/pwned-range/{prefix}": {
      "get": {
        "operationId": "watchtower_pwned_range",
        "parameters": [
          {
            "description": "First 5 hex characters of the SHA-1",
            "in": "path",
            "name": "prefix",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "text/plain": {
                "schema": {
                  "type": "string"
                }
              }
            },
            "description": "OK"
          },
          "422": {
            "description": "Not a 5-character hex prefix"
          },
          "429": {
            "description": "Rate limited"
          },
          "503": {
            "description": "Upstream unavailable or breach checks paused"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Suffixes under a 5-character SHA-1 prefix, padded with decoys to a fixed size. Each line is\n`SUFFIX:COUNT` with a 10-digit count. Lines with count 0 are padding.",
        "tags": [
          "watchtower"
        ]
      }
    },
    "/v1/webhooks": {
      "get": {
        "operationId": "list_webhooks",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Page_Webhook"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The account's webhooks the caller may manage.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "operationId": "create_webhooks",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateWebhook"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CreatedWebhook"
                }
              }
            },
            "description": "Created"
          },
          "422": {
            "description": "Invalid webhook"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Creates a webhook. The signing secret is in this answer only.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/webhooks/{id}": {
      "delete": {
        "operationId": "delete_webhooks",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No content"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Deletes a webhook and its delivery history.",
        "tags": [
          "secrets"
        ]
      },
      "get": {
        "operationId": "get_webhooks",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Webhook"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "One webhook.",
        "tags": [
          "secrets"
        ]
      },
      "patch": {
        "operationId": "update_webhooks",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateWebhook"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Webhook"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "Changes the URL, events or description, or turns a webhook on or off.",
        "tags": [
          "secrets"
        ]
      },
      "post": {
        "description": "- `:test` queues a signed `webhook.test` event and answers `202 {\"event_id\"}`.\n- `:rotateSecret` takes `{\"overlap_hours\": n}` and answers the webhook with its new signing\n  secret, shown once. Until the overlap ends every delivery carries a `v1` signature from the\n  new secret and one from the old, so receivers can switch at any point in the window.",
        "operationId": "test_webhooks",
        "parameters": [
          {
            "description": "<webhook id>:test or <webhook id>:rotateSecret",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "oneOf": [
                  {
                    "$ref": "#/components/schemas/RotateWebhookSecret"
                  },
                  {
                    "type": "null"
                  }
                ]
              }
            }
          },
          "description": "`:rotateSecret` only"
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CreatedWebhook"
                }
              }
            },
            "description": "Secret rotated"
          },
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebhookTest"
                }
              }
            },
            "description": "Test event queued"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "`:test` and `:rotateSecret` on a webhook. axum cannot route on a suffix inside a segment, so\nthe segment arrives as `<id>:<verb>` and is split here.",
        "tags": [
          "secrets"
        ]
      }
    },
    "/v1/webhooks/{id}/deliveries": {
      "get": {
        "operationId": "list_webhook_deliveries",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Page_WebhookDelivery"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [
          {
            "dpop_session": []
          }
        ],
        "summary": "The newest deliveries of a webhook.",
        "tags": [
          "secrets"
        ]
      }
    }
  },
  "servers": [
    {
      "url": "https://api.sphragis.siliconblast.com"
    }
  ],
  "tags": [
    {
      "description": "Health and metadata",
      "name": "ops"
    },
    {
      "description": "The signed-in person",
      "name": "me"
    },
    {
      "description": "Vault registration and unlock",
      "name": "unlock"
    },
    {
      "description": "Devices and sessions",
      "name": "devices"
    },
    {
      "description": "Secrets projects, environments, secrets and machine identities",
      "name": "secrets"
    },
    {
      "description": "Role bindings and permission checks",
      "name": "iam"
    },
    {
      "description": "Family and Team accounts, members, invitations and groups",
      "name": "accounts"
    },
    {
      "description": "Encrypted file attachments",
      "name": "attachments"
    },
    {
      "description": "Breach ranges and site directories for on-device checks",
      "name": "watchtower"
    },
    {
      "description": "Audit events, chain verification and signed checkpoints",
      "name": "audit"
    },
    {
      "description": "Plans, Stripe Checkout, the customer portal, usage and Stripe webhooks",
      "name": "billing"
    },
    {
      "description": "SiliconBlast Identity (SBI) sign-in, sign-up and email links for the web vault",
      "name": "sib"
    }
  ]
}