{"openapi":"3.1.0","info":{"title":"a2a.training agent API","version":"0.1.0"},"paths":{"/v1/submissions":{"post":{"summary":"Submit a configuration, loop definition or memory/connections file, as one file, several files or one zip/tar archive, or one failure report as a JSON file (R-01 to R-12, R-28, A-02).","operationId":"submit_v1_submissions_post","requestBody":{"content":{"multipart/form-data":{"schema":{"$ref":"#/components/schemas/Body_submit_v1_submissions_post"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionAccepted"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}}},"409":{"description":"Conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}}},"413":{"description":"Request Entity Too Large","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}}},"429":{"description":"Too Many Requests","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"agent_token":[]}]}},"/v1/submissions/{submission_id}/findings":{"get":{"summary":"Retrieve the finding list of a submission with the submitting agent's own token (R-16).","operationId":"get_findings_v1_submissions__submission_id__findings_get","security":[{"agent_token":[]}],"parameters":[{"name":"submission_id","in":"path","required":true,"schema":{"type":"string","title":"Submission Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FindingList"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/operator/submissions/{submission_id}/findings":{"get":{"summary":"Retrieve the finding list of a submission owned by one of the authenticated operator's agents, with the account key (R-16).","operationId":"get_operator_findings_v1_operator_submissions__submission_id__findings_get","security":[{"account_key":[]}],"parameters":[{"name":"submission_id","in":"path","required":true,"schema":{"type":"string","title":"Submission Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FindingList"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/operator/submissions/{submission_id}":{"get":{"summary":"Retrieve an accepted submission of one of the authenticated operator's agents by its id: id, receipt timestamp, filter-rule version and data class (R-12).","operationId":"get_operator_submission_v1_operator_submissions__submission_id__get","security":[{"account_key":[]}],"parameters":[{"name":"submission_id","in":"path","required":true,"schema":{"type":"string","title":"Submission Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionView"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/operator/findings":{"get":{"summary":"Retrieve every finding list of every one of the authenticated operator's agents, in one call, with the account key (R-16).","operationId":"get_all_operator_findings_v1_operator_findings_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/FindingList"},"type":"array","title":"Response Get All Operator Findings V1 Operator Findings Get"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]}},"/v1/agents":{"get":{"summary":"List the authenticated operator's own agents that are not deleted, with the account key (R-28).","operationId":"list_agents_v1_agents_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/AgentSummary"},"type":"array","title":"Response List Agents V1 Agents Get"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]},"post":{"summary":"Register an agent for the authenticated operator and issue its token (R-02).","operationId":"register_agent_v1_agents_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRegistration"}}},"required":true},"responses":{"201":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRegistered"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"account_key":[]}]}},"/v1/operator/rules":{"get":{"summary":"Retrieve which of the authenticated operator's failure reports fed into which rules, with the account key (R-22).","operationId":"get_operator_rules_v1_operator_rules_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/ProvenanceRecordView"},"type":"array","title":"Response Get Operator Rules V1 Operator Rules Get"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]}},"/v1/account/email-registration":{"post":{"summary":"Start an account: send a single-use confirmation link and code, valid 30 minutes, to a company e-mail address, one that is not on the freemail list (MVP-R-36, MVP-R-37, MVP-R-41).","operationId":"start_email_registration_v1_account_email_registration_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailRegistration"}}},"required":true},"responses":{"202":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailRegistrationAccepted"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"429":{"description":"Too Many Requests","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"502":{"description":"Bad Gateway","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"503":{"description":"Service Unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/account/email-confirmation":{"post":{"summary":"Confirm the address: creates the account with this owner address and shows its key once, or replaces the key of the account of the address (MVP-R-37, MVP-R-40).","operationId":"confirm_email_v1_account_email_confirmation_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailConfirmation"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccountRegistered"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"503":{"description":"Service Unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/account/owner-address":{"post":{"summary":"An account made by the former domain proof, which has no owner address yet, asks for a code to an address of its proven domain, with the account key (MVP-R-100).","operationId":"request_owner_address_v1_account_owner_address_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerAddressRequest"}}},"required":true},"responses":{"202":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailRegistrationAccepted"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"429":{"description":"Too Many Requests","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"502":{"description":"Bad Gateway","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"503":{"description":"Service Unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"account_key":[]}]}},"/v1/account/owner-address/confirmation":{"post":{"summary":"Confirm the code: the address becomes the owner address of the account; key, agents, checks, findings and grants stay (MVP-R-100).","operationId":"confirm_owner_address_v1_account_owner_address_confirmation_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerAddressConfirmation"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerAddressConfirmed"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"503":{"description":"Service Unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"account_key":[]}]}},"/v1/account/members/invitations":{"post":{"summary":"The owner invites a colleague: a single-use link and code, valid seven days, go to an address of the domain of the owner address (MVP-R-88).","operationId":"invite_member_v1_account_members_invitations_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberInvitationRequest"}}},"required":true},"responses":{"202":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberInvitationAccepted"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"409":{"description":"Conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"429":{"description":"Too Many Requests","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"502":{"description":"Bad Gateway","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"503":{"description":"Service Unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"account_key":[]}]}},"/v1/account/members":{"get":{"summary":"The members of the account with the time of joining, and its open invitations (MVP-R-88).","operationId":"list_members_v1_account_members_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberList"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]}},"/v1/account/members/{member_id}":{"delete":{"summary":"The owner removes a member: its web sessions end at once and the grants it approved are revoked; the grants of the owner stay (MVP-R-88, MVP-R-52).","operationId":"remove_member_v1_account_members__member_id__delete","security":[{"account_key":[]}],"parameters":[{"name":"member_id","in":"path","required":true,"schema":{"type":"string","title":"Member Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberRemoved"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Forbidden"},"404":{"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/account/members/invitations/{invitation_id}":{"delete":{"summary":"The owner withdraws an invitation until it is used (MVP-R-88).","operationId":"withdraw_invitation_v1_account_members_invitations__invitation_id__delete","security":[{"account_key":[]}],"parameters":[{"name":"invitation_id","in":"path","required":true,"schema":{"type":"string","title":"Invitation Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationWithdrawn"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Forbidden"},"404":{"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/account/members/invitations/confirmation":{"post":{"summary":"The invited person confirms with the code or the link of the mail: the address becomes a member of the inviting account; no key is shown (MVP-R-88).","operationId":"confirm_invitation_v1_account_members_invitations_confirmation_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationConfirmation"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberJoined"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"503":{"description":"Service Unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/agents/{agent_id}/token":{"post":{"summary":"Revoke an agent's current token and issue a new one (R-31).","operationId":"reissue_agent_token_v1_agents__agent_id__token_post","security":[{"account_key":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentTokenIssued"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"delete":{"summary":"Revoke an agent's token without replacement (R-31).","operationId":"revoke_agent_token_v1_agents__agent_id__token_delete","security":[{"account_key":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentTokenRevoked"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/agents/{agent_id}":{"delete":{"summary":"Delete an agent on request: removes its submissions and finding lists (R-27).","operationId":"delete_agent_v1_agents__agent_id__delete","security":[{"account_key":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"responses":{"204":{"description":"Successful Response"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/account":{"get":{"summary":"The authenticated operator's account: kind, tier, plan, per limit its period, use and rest, and the address of the tier page where one exists (MVP-R-110).","operationId":"get_account_view_v1_account_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccountView"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]},"delete":{"summary":"Delete the authenticated operator's whole account on request: every agent, submission and finding list, then the account key (R-27).","operationId":"delete_account_v1_account_delete","responses":{"204":{"description":"Successful Response"},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]}},"/v1/account/setup-prompt-copied":{"post":{"summary":"Count that the person pressed the button next to the setup prompt (MVP-R-113, MVP-R-143): one count per account and week, nothing else is stored.","operationId":"setup_prompt_copied_v1_account_setup_prompt_copied_post","responses":{"204":{"description":"Successful Response"},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]}},"/v1/account/first-check-shown":{"post":{"summary":"Count that the page of the first check was shown to the account: one count per account and week, nothing else is stored.","operationId":"first_check_shown_v1_account_first_check_shown_post","responses":{"204":{"description":"Successful Response"},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]}},"/v1/account/cost-budget":{"get":{"summary":"Read the authenticated operator's daily cost budget for model-supported checks (R-43); null when none is set.","operationId":"read_cost_budget_v1_account_cost_budget_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CostBudgetView"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]},"put":{"summary":"Set or unset the authenticated operator's daily cost budget for model-supported checks (R-43): without one the service checks deterministically only and marks every model-supported rule as skipped.","operationId":"set_cost_budget_v1_account_cost_budget_put","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CostBudgetChange"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CostBudgetView"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"503":{"description":"Service Unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"account_key":[]}]}},"/v1/account/reminders":{"get":{"summary":"Read the reminder setting of the authenticated account (MVP-R-115): on or off and the number of days after which an agent without a check is reminded (default 30, from 7 to 90).","operationId":"read_reminders_v1_account_reminders_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReminderView"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]},"put":{"summary":"Set the reminder setting of the authenticated account (MVP-R-115): `enabled` and `period_days` (7 to 90). A field left out keeps its value. Only accounts of the tier premium receive reminder mails.","operationId":"set_reminders_v1_account_reminders_put","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReminderChange"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReminderView"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"422":{"description":"Unprocessable Entity","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]}},"/v1/reminders/off":{"post":{"summary":"The link of a reminder mail (MVP-R-115): turns the reminders of its account off. The token is the link's own secret; no account key and no sign-in. An unknown or expired token is a 404.","operationId":"turn_reminders_off_v1_reminders_off_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReminderOffRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReminderView"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/agents/{agent_id}/sharing-policy":{"put":{"summary":"Set (a subset of) an agent's sharing policy (R-03).","operationId":"set_sharing_policy_v1_agents__agent_id__sharing_policy_put","security":[{"account_key":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SharingPolicyChange"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SharingPolicyView"}}}},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/agent/sharing-policy":{"get":{"summary":"Read the presenting agent's own sharing policy; no write path exists for an agent (R-05).","operationId":"read_own_sharing_policy_v1_agent_sharing_policy_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SharingPolicyView"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}}}},"security":[{"agent_token":[]}]}},"/v1/internal/metrics":{"get":{"summary":"Internal-only process metrics (R-30): active agents and operators (30-day window), submissions per week and data class, the share of resolved findings on resubmission, and published rules per rule class -- aggregated counts only, no raw data and no operator or agent identifiers.","operationId":"get_internal_metrics_v1_internal_metrics_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MetricsSnapshot"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"internal_metrics_secret":[]}]}},"/v1/catalogs/{catalog_id}":{"get":{"summary":"Retrieve the public rule catalog (R-23), unauthenticated, under CC-BY-4.0; catalog_id is \"rules\" for now.","operationId":"get_catalog_v1_catalogs__catalog_id__get","parameters":[{"name":"catalog_id","in":"path","required":true,"schema":{"type":"string","title":"Catalog Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleCatalogView"}}}},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/catalog/patterns":{"get":{"summary":"Retrieve the public pattern catalogue (MVP-R-17), unauthenticated, under CC-BY-4.0: each pattern with its rationale, a before and an after example, its source and the rules that link to it.","operationId":"get_pattern_catalogue_v1_catalog_patterns_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PatternCatalogView"}}}}}}},"/v1/setup-prompts/claude-code":{"get":{"summary":"Retrieve the newest setup prompt for Claude Code (MVP-R-143, MVP-R-151), unauthenticated: the text of `catalog/setup-prompt-claude-code-<version>.md` as Markdown, with `?lang=de` the German `catalog/setup-prompt-claude-code-de-<version>.md`; `Content-Location` and `X-Setup-Prompt-Version` name the version, `Content-Language` the language.","operationId":"get_setup_prompt_v1_setup_prompts_claude_code_get","parameters":[{"name":"lang","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Lang"}}],"responses":{"200":{"description":"Successful Response","content":{"text/markdown":{}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/setup-prompts/claude-code/{version}":{"get":{"summary":"Retrieve one published version of the setup prompt for Claude Code (MVP-R-143), unauthenticated; a published version never changes.","operationId":"get_setup_prompt_version_v1_setup_prompts_claude_code__version__get","parameters":[{"name":"version","in":"path","required":true,"schema":{"type":"string","title":"Version"}},{"name":"lang","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Lang"}}],"responses":{"200":{"description":"Successful Response","content":{"text/markdown":{}}},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/checks/{check_id}":{"get":{"summary":"Retrieve a check: its state, the time of every transition, the package, catalogue and adapter versions and, once the own rules have completed, the finding list in contract version 1 (MVP-R-04).","operationId":"get_check_v1_checks__check_id__get","security":[{"check_reader":[]}],"parameters":[{"name":"check_id","in":"path","required":true,"schema":{"type":"string","title":"Check Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckViewWithUsage"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/agents/{agent_id}/check-state":{"get":{"summary":"The state of a configuration of the agent, by its content hash: `gueltig`, `blockiert`, `abgelaufen` or `fehlt`, with the check that decides and the time it finished (MVP-R-93). Agent credential or account key; it creates nothing and counts against a limit per agent.","operationId":"get_check_state_v1_agents__agent_id__check_state_get","security":[{"check_reader":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}},{"name":"fingerprint","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The content hash of the package (64 lower-case hexadecimal characters).","title":"Fingerprint"},"description":"The content hash of the package (64 lower-case hexadecimal characters)."}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckStateView"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Unprocessable Entity"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Too Many Requests"}}}},"/v1/agents/{agent_id}/skipped-checks":{"post":{"summary":"Record that a check of the agent was skipped: the content hash, who skipped it and why (MVP-R-93). Agent credential or account key; the operator reads the events per agent and the metrics count them per week.","operationId":"record_skipped_check_v1_agents__agent_id__skipped_checks_post","security":[{"check_reader":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkippedCheckRequest"}}}},"responses":{"201":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkippedCheckView"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Too Many Requests"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"get":{"summary":"The skipped checks recorded for an agent of the account, newest first, at most 100, kept 90 days (MVP-R-93). Account key.","operationId":"list_skipped_checks_v1_agents__agent_id__skipped_checks_get","security":[{"account_key":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkippedChecksView"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/agents/{agent_id}/guard-counts":{"post":{"summary":"Store the counts of the guard at run time: per UTC day the rule ID, the number of hits and the decision, never a command, path, URL, result or session ID (MVP-R-142). Agent credential or account key; tier premium only (403 naming the tier otherwise); the numbers are absolute and replace the earlier ones.","operationId":"record_guard_counts_v1_agents__agent_id__guard_counts_post","security":[{"check_reader":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GuardCountsRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GuardCountsStored"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unprocessable Entity"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionRejected"}}},"description":"Too Many Requests"}}},"get":{"summary":"The counts of the guard of an agent of the account per ISO week, rule and decision, newest week first, kept 90 days (MVP-R-142). Account key.","operationId":"list_guard_counts_v1_agents__agent_id__guard_counts_get","security":[{"account_key":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GuardWeeksView"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/operator/findings/{finding_id}/acknowledge":{"post":{"summary":"Acknowledge the escalation of a finding with the account key; the next re-check of that chain is accepted and its count restarts (MVP-R-21).","operationId":"acknowledge_finding_v1_operator_findings__finding_id__acknowledge_post","security":[{"account_key":[]}],"parameters":[{"name":"finding_id","in":"path","required":true,"schema":{"type":"string","title":"Finding Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FindingAcknowledged"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/operator/findings/{finding_id}/verdict":{"put":{"summary":"Record the verdict of a finding of the account (`zutreffend`, `fehlalarm`, `nicht_anwendbar` or `unklar`) with the account key; a new verdict replaces the earlier one and changes no score, status or rule (MVP-R-79).","operationId":"put_finding_verdict_v1_operator_findings__finding_id__verdict_put","security":[{"account_key":[]}],"parameters":[{"name":"finding_id","in":"path","required":true,"schema":{"type":"string","title":"Finding Id"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FindingVerdictBody"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FindingVerdictView"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"get":{"summary":"Read the verdict of a finding of the account with its time of setting, or `null` while none is recorded (MVP-R-79).","operationId":"get_finding_verdict_v1_operator_findings__finding_id__verdict_get","security":[{"account_key":[]}],"parameters":[{"name":"finding_id","in":"path","required":true,"schema":{"type":"string","title":"Finding Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FindingVerdictView"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/operator/pilot-report":{"get":{"summary":"The pilot report of the account for a time range in UTC: checks per state, findings per class and rule, verdicts, `behoben`/`neu` pairs and re-checks, counted from the stored checks; no model, no new score (MVP-R-80).","operationId":"pilot_report_v1_operator_pilot_report_get","security":[{"account_key":[]}],"parameters":[{"name":"from","in":"query","required":true,"schema":{"type":"string","format":"date-time","title":"From"}},{"name":"to","in":"query","required":true,"schema":{"type":"string","format":"date-time","title":"To"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PilotReport"}}}},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/operator/checks":{"get":{"summary":"List the checks of the authenticated operator's agents, newest first, with pagination, with the account key (MVP-R-04).","operationId":"list_checks_v1_operator_checks_get","security":[{"account_key":[]}],"parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","maximum":100,"minimum":1,"default":50,"title":"Limit"}},{"name":"cursor","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cursor"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckPage"}}}},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/v1/account/mcp-grants":{"get":{"summary":"List the MCP connections (grants) of the account (MVP-R-52).","operationId":"list_mcp_grants_v1_account_mcp_grants_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/McpGrantList"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}}}},"security":[{"account_key":[]}]}},"/v1/account/mcp-grants/{grant_id}":{"delete":{"summary":"End one MCP connection (grant) of the account (MVP-R-52).","operationId":"revoke_mcp_grant_v1_account_mcp_grants__grant_id__delete","security":[{"account_key":[]}],"parameters":[{"name":"grant_id","in":"path","required":true,"schema":{"type":"string","title":"Grant Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/McpGrantRevoked"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperatorRequestRejected"}}},"description":"Unauthorized"},"404":{"description":"Not Found"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/.well-known/agent-card.json":{"get":{"summary":"The service's own Agent Card (MVP-R-28); the current path.","operationId":"_card__well_known_agent_card_json_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"405":{"description":"method_not_allowed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/A2AErrorPayload"}}}}}}},"/.well-known/agent.json":{"get":{"summary":"The service's own Agent Card (MVP-R-28); the legacy path (MVP-R-27).","operationId":"_card__well_known_agent_json_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"405":{"description":"method_not_allowed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/A2AErrorPayload"}}}}}}},"/a2a":{"post":{"summary":"The A2A task endpoint (MVP-R-28, MVP-R-29): JSON-RPC 2.0 `message/send` with a package returns the check id at once as a task; `tasks/get` returns its state and, once finished, the finding list as artifact. Errors use the seven categories of `A2AErrorCategory`.","operationId":"a2a_a2a_post","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/A2AResultPayload"}}}},"404":{"description":"endpoint_not_found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/A2AErrorPayload"}}}},"405":{"description":"method_not_allowed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/A2AErrorPayload"}}}},"401":{"description":"authentication_required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/A2AErrorPayload"}}}},"504":{"description":"timeout","content":{"application/json":{"schema":{"$ref":"#/components/schemas/A2AErrorPayload"}}}},"502":{"description":"invalid_response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/A2AErrorPayload"}}}},"400":{"description":"incompatible_protocol_version","content":{"application/json":{"schema":{"$ref":"#/components/schemas/A2AErrorPayload"}}}}}}},"/v1/agents/{agent_id}/behavior-release":{"get":{"summary":"Read whether the agent's release for behavioural checks is on (MVP-R-148). Off by default, apart from the data classes of the release rule. Account key or web session.","operationId":"read_behavior_release_v1_agents__agent_id__behavior_release_get","security":[{"account_key":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"title":"Response Read Behavior Release V1 Agents  Agent Id  Behavior Release Get"}}}},"401":{"description":"no or unknown credential"},"403":{"description":"refused, naming the reason"},"404":{"description":"no such agent or check"},"422":{"description":"refused, naming the reason"},"429":{"description":"a limit of the tier"}}},"put":{"summary":"Turn the agent's release for behavioural checks on or off (MVP-R-148). Without it the service refuses every upload of action logs. Account key.","operationId":"set_behavior_release_v1_agents__agent_id__behavior_release_put","security":[{"account_key":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BehaviorRelease"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"title":"Response Set Behavior Release V1 Agents  Agent Id  Behavior Release Put"}}}},"401":{"description":"no or unknown credential"},"403":{"description":"refused, naming the reason"},"404":{"description":"no such agent or check"},"422":{"description":"refused, naming the reason"},"429":{"description":"a limit of the tier"}}}},"/v1/agents/{agent_id}/behavior-checks":{"post":{"summary":"Upload the action logs of one behavioural check from the local runner (MVP-R-148). Agent credential or account key; tier premium or pilot mode; the agent's release for behavioural checks must be on. The service judges every complete log itself and answers the result (MVP-R-149, MVP-R-150). One behavioural check counts as one check for the limits of the tier.","operationId":"upload_behavior_check_v1_agents__agent_id__behavior_checks_post","security":[{"check_reader":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BehaviorUpload"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"title":"Response Upload Behavior Check V1 Agents  Agent Id  Behavior Checks Post"}}}},"401":{"description":"no or unknown credential"},"403":{"description":"refused, naming the reason"},"404":{"description":"no such agent or check"},"422":{"description":"refused, naming the reason"},"429":{"description":"a limit of the tier"}}},"get":{"summary":"The behavioural results of an agent of the account, newest first, each with whether it has expired and whether it counts for the agent's current package (MVP-R-150). Account key or web session.","operationId":"list_behavior_checks_v1_agents__agent_id__behavior_checks_get","security":[{"account_key":[]}],"parameters":[{"name":"agent_id","in":"path","required":true,"schema":{"type":"string","title":"Agent Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"title":"Response List Behavior Checks V1 Agents  Agent Id  Behavior Checks Get"}}}},"401":{"description":"no or unknown credential"},"403":{"description":"refused, naming the reason"},"404":{"description":"no such agent or check"},"422":{"description":"refused, naming the reason"},"429":{"description":"a limit of the tier"}}}},"/v1/behavior-checks/{check_id}":{"get":{"summary":"One behavioural result (schema behavior-result-1.0.0), whether it has expired and whether it counts for the agent's current package (MVP-R-150). Account key or web session.","operationId":"read_behavior_check_v1_behavior_checks__check_id__get","security":[{"account_key":[]}],"parameters":[{"name":"check_id","in":"path","required":true,"schema":{"type":"string","title":"Check Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"title":"Response Read Behavior Check V1 Behavior Checks  Check Id  Get"}}}},"401":{"description":"no or unknown credential"},"403":{"description":"refused, naming the reason"},"404":{"description":"no such agent or check"},"422":{"description":"refused, naming the reason"},"429":{"description":"a limit of the tier"}}}}},"components":{"schemas":{"A2AErrorCategory":{"type":"string","enum":["endpoint_not_found","method_not_allowed","authentication_required","timeout","invalid_response","malformed_json","incompatible_protocol_version"],"title":"A2AErrorCategory","description":"The categories of errors on the A2A path and on card retrieval, exactly these\nseven (MVP-R-29); each is in the OpenAPI document and in the A2A error payload."},"A2AErrorData":{"properties":{"category":{"$ref":"#/components/schemas/A2AErrorCategory"},"detail":{"additionalProperties":true,"type":"object","title":"Detail"}},"type":"object","required":["category"],"title":"A2AErrorData"},"A2AErrorObject":{"properties":{"code":{"type":"integer","title":"Code"},"message":{"type":"string","title":"Message"},"data":{"$ref":"#/components/schemas/A2AErrorData"}},"type":"object","required":["code","message","data"],"title":"A2AErrorObject"},"A2AErrorPayload":{"properties":{"jsonrpc":{"type":"string","const":"2.0","title":"Jsonrpc","default":"2.0"},"id":{"anyOf":[{"type":"string"},{"type":"integer"},{"type":"null"}],"title":"Id"},"error":{"$ref":"#/components/schemas/A2AErrorObject"}},"type":"object","required":["error"],"title":"A2AErrorPayload","description":"The error body of the A2A path and of card retrieval: a JSON-RPC 2.0 error\nwhose `data.category` is one of the seven categories of MVP-R-29."},"A2AResultPayload":{"properties":{"jsonrpc":{"type":"string","const":"2.0","title":"Jsonrpc","default":"2.0"},"id":{"anyOf":[{"type":"string"},{"type":"integer"},{"type":"null"}],"title":"Id"},"result":{"additionalProperties":true,"type":"object","title":"Result"}},"type":"object","required":["result"],"title":"A2AResultPayload","description":"The success body: a JSON-RPC 2.0 result holding an A2A task (`kind: task`)."},"AccountRegistered":{"properties":{"operator_id":{"type":"string","title":"Operator Id"},"email":{"type":"string","title":"Email"},"account_key":{"type":"string","title":"Account Key"},"registration_outcome":{"$ref":"#/components/schemas/RegistrationOutcome"}},"type":"object","required":["operator_id","email","account_key","registration_outcome"],"title":"AccountRegistered","description":"The answer to a confirmed address: the account key, shown once (MVP-R-37), and what the\nconfirmation did: `registered` for a new account whose owner address this is, `key_replaced`\nwhen the address had one and its key was replaced (MVP-R-40)."},"AccountUsageView":{"properties":{"limit":{"type":"string","title":"Limit"},"period":{"type":"string","enum":["utc_day","utc_month"],"title":"Period"},"maximum":{"type":"integer","title":"Maximum"},"used":{"type":"integer","title":"Used"},"rest":{"type":"integer","title":"Rest"}},"type":"object","required":["limit","period","maximum","used","rest"],"title":"AccountUsageView","description":"One limit of the account with its use in the current period (MVP-R-38, DF-13): the checks of the\nUTC day and, on a tier with a monthly limit, of the UTC month. Same figures as `get_account`."},"AccountView":{"properties":{"account_tier":{"type":"string","title":"Account Tier"},"plan":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Plan"},"account_limits":{"additionalProperties":{"anyOf":[{"type":"integer"},{"type":"string"}]},"type":"object","title":"Account Limits"},"limit_usage":{"items":{"$ref":"#/components/schemas/LimitUsage"},"type":"array","title":"Limit Usage"},"checks_left_today":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Checks Left Today"},"upgrade_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Upgrade Url"}},"type":"object","required":["account_tier","account_limits","checks_left_today"],"title":"AccountView","description":"`get_account`: the tier of the account (`free` or `premium`), the plan (`null` until a plan\nis recorded, MVP-R-39), its limits with their use and rest, the checks left today and, only\nwhere the operator has a tier page and a public origin, `upgrade_url` (MVP-R-110). There is no\nkind of account since point 91: every account is a company account (MVP-R-36)."},"ActionScore":{"properties":{"score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Score"},"applicable_rules":{"type":"integer","title":"Applicable Rules"}},"type":"object","required":["score","applicable_rules"],"title":"ActionScore"},"AgentCardErrorView":{"properties":{"category":{"type":"string","title":"Category"},"message":{"type":"string","title":"Message"}},"type":"object","required":["category","message"],"title":"AgentCardErrorView","description":"Why the agent card could not be read (MVP-R-27): one of the seven categories of\nMVP-R-29 and a sentence. It never changes the check's state."},"AgentCardProvenance":{"properties":{"source":{"type":"string","const":"agent_card","title":"Source"},"protocol_version":{"type":"string","title":"Protocol Version"}},"additionalProperties":false,"type":"object","required":["source","protocol_version"],"title":"AgentCardProvenance","description":"The agent card, read under a protocol version."},"AgentCardView":{"properties":{"status":{"type":"string","enum":["read","error"],"title":"Status"},"source":{"type":"string","enum":["package","url"],"title":"Source"},"url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Url"},"fetched_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Fetched At"},"protocol_version":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Protocol Version"},"name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Name"},"version":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Version"},"endpoints":{"items":{"type":"string"},"type":"array","title":"Endpoints"},"input_modes":{"items":{"type":"string"},"type":"array","title":"Input Modes"},"output_modes":{"items":{"type":"string"},"type":"array","title":"Output Modes"},"authentication":{"items":{"type":"string"},"type":"array","title":"Authentication"},"skills":{"items":{"type":"string"},"type":"array","title":"Skills"},"error":{"anyOf":[{"$ref":"#/components/schemas/AgentCardErrorView"},{"type":"null"}]}},"type":"object","required":["status","source"],"title":"AgentCardView","description":"The record of the agent's card in a check (MVP-R-25, MVP-R-27): where it came\nfrom (`package` or `url`), and either what was read (protocol version, identity,\nversion, declared skills, endpoints, formats, authentication, time read) or `error`.\nIts findings are in the finding list with the provenance `agent_card`."},"AgentRegistered":{"properties":{"agent_id":{"type":"string","title":"Agent Id"},"name":{"type":"string","title":"Name"},"purpose_statement":{"type":"string","title":"Purpose Statement"},"success_criterion":{"type":"string","title":"Success Criterion"},"domain_tags":{"items":{"type":"string"},"type":"array","title":"Domain Tags"},"agent_token":{"type":"string","title":"Agent Token"}},"type":"object","required":["agent_id","name","purpose_statement","success_criterion","domain_tags","agent_token"],"title":"AgentRegistered","description":"The response body for a newly registered agent (R-02). `agent_token`\nis shown here once, the same way `Registration.account_key`\n(`a2a/accounts/service.py`) and `IssuedAgent.agent_token`\n(`a2a/agents/service.py`) already are -- the service keeps only a hash,\nso this response is the only place either secret is ever readable\nagain."},"AgentRegistration":{"properties":{"name":{"type":"string","title":"Name"},"purpose_statement":{"type":"string","title":"Purpose Statement"},"success_criterion":{"type":"string","title":"Success Criterion"},"domain_tags":{"items":{"type":"string"},"type":"array","title":"Domain Tags"}},"type":"object","required":["name","purpose_statement","success_criterion","domain_tags"],"title":"AgentRegistration","description":"The request body for `POST /v1/agents` (R-02): everything\n`AgentService.register` needs besides the authenticated operator, which\ncomes from the account key, never from the body."},"AgentSummary":{"properties":{"agent_id":{"type":"string","title":"Agent Id"},"name":{"type":"string","title":"Name"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"revoked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Revoked At"},"sharing_policy":{"$ref":"#/components/schemas/SharingPolicyView"}},"type":"object","required":["agent_id","name","created_at","revoked_at","sharing_policy"],"title":"AgentSummary","description":"One entry of the response to `GET /v1/agents` (R-28, Decision 0042):\nan agent of the authenticated operator, as far as an operator's web\ninterface needs it to list, revoke and set rules on its agents.\n\nEvery field name is a glossary term already (`agent_field`, `created_at`\nfrom `finding_list_field`, `sharing_policy`): `revoked_at` is the stored\n`Agent.token_revoked_at`, `null` while the token is usable, and no\nboolean \"token active\" is invented next to it (the same reasoning as\n`AgentTokenRevoked`, Codex review of #19). The entry never carries a\ntoken or a token hash: the token is shown once, at registration or\nreissue (R-31), and nowhere else. `sharing_policy` is the complete rule\nof R-03, all five data classes, `blocked` for an agent nobody has set a\nrule for. `name` is the agent's own name (`agent_field`, decision 0047), so\nan operator can tell agents apart without reading ids."},"AgentTokenIssued":{"properties":{"agent_id":{"type":"string","title":"Agent Id"},"agent_token":{"type":"string","title":"Agent Token"}},"type":"object","required":["agent_id","agent_token"],"title":"AgentTokenIssued","description":"The response body for `POST /v1/agents/{agent_id}/token` (R-31):\nthe new token, shown once like `AgentRegistered.agent_token`."},"AgentTokenRevoked":{"properties":{"agent_id":{"type":"string","title":"Agent Id"},"revoked_at":{"type":"string","format":"date-time","title":"Revoked At"}},"type":"object","required":["agent_id","revoked_at"],"title":"AgentTokenRevoked","description":"The response body for `DELETE /v1/agents/{agent_id}/token` (R-31).\n`revoked_at` is `agent_field`'s own glossary term (`catalog/glossary.yaml`\n-- \"widerrufen am\") for `Agent.token_revoked_at`, reused as-is rather\nthan a new boolean concept invented for this response (Codex review of\n#19: `catalog/glossary.yaml` already names this state; introducing a\nsecond, ungoverned name for it is exactly what `AGENTS.md`'s glossary\nrule forbids)."},"AssuranceLimitV15":{"properties":{"key":{"type":"string","title":"Key"},"de":{"type":"string","title":"De"},"en":{"type":"string","title":"En"}},"additionalProperties":false,"type":"object","required":["key","de","en"],"title":"AssuranceLimitV15","description":"One sentence of `assurance_limits` (MVP-R-65): its stable key and both texts."},"AssuranceLimitView":{"properties":{"key":{"type":"string","title":"Key"},"de":{"type":"string","title":"De"},"en":{"type":"string","title":"En"}},"additionalProperties":false,"type":"object","required":["key","de","en"],"title":"AssuranceLimitView","description":"One sentence of `assurance_limits` as the finding-list routes answer it (MVP-R-65)."},"BehaviorRelease":{"properties":{"enabled":{"type":"boolean","title":"Enabled"}},"additionalProperties":false,"type":"object","required":["enabled"],"title":"BehaviorRelease"},"BehaviorUpload":{"properties":{"logs":{"items":{"additionalProperties":true,"type":"object"},"type":"array","title":"Logs"}},"additionalProperties":false,"type":"object","required":["logs"],"title":"BehaviorUpload","description":"The body of `POST /v1/agents/{agent_id}/behavior-checks`: the action logs of one check (schema `action-log-1.0.0`)."},"BehobenNeuPair":{"properties":{"check_id":{"type":"string","title":"Check Id"},"rule_id":{"type":"string","title":"Rule Id"},"location":{"type":"string","title":"Location"},"behoben_finding_id":{"type":"string","title":"Behoben Finding Id"},"neu_finding_id":{"type":"string","title":"Neu Finding Id"}},"additionalProperties":false,"type":"object","required":["check_id","rule_id","location","behoben_finding_id","neu_finding_id"],"title":"BehobenNeuPair"},"Body_submit_v1_submissions_post":{"properties":{"data_class":{"type":"string","enum":["configuration","loop","memory_and_connections","failure_report","questionnaire"],"title":"Data Class"},"harness":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Harness"},"files":{"items":{"type":"string","contentMediaType":"application/octet-stream"},"type":"array","title":"Files"},"recheck_of":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Recheck Of"},"addressed_finding_ids":{"items":{"type":"string"},"type":"array","title":"Addressed Finding Ids"},"agent_card_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Agent Card Url"}},"type":"object","required":["data_class","files"],"title":"Body_submit_v1_submissions_post"},"CatalogCheckLogic":{"properties":{"check":{"type":"string","title":"Check"},"check_args":{"additionalProperties":true,"type":"object","title":"Check Args"}},"type":"object","required":["check","check_args"],"title":"CatalogCheckLogic","description":"`CatalogRuleView.check_logic` (R-23, Decision 0040): the \"Prüflogik\"\nR-23 asks the public catalog route to publish for every rule --\n`a2a.engine.catalog.Rule.check`, the name of the check function in\n`a2a.engine.checks` that runs the rule, and `check_args`, the\narguments it runs with. Deliberately not `check_type` (\"Prüfart\":\ndeterministic or model-based) or `checks` (\"Prüfgegenstand\": presence,\nabsence or property) -- R-23's instruction for this route names only\n\"Prüflogik\", and `check`/`check_args` are the two fields that actually\ndecide what the rule tests; the other two are left for a later PR if\none ever asks for them (AF-18: not built ahead of that ask)."},"CatalogCrossReference":{"properties":{"tool":{"type":"string","title":"Tool"},"tool_rule_id":{"type":"string","title":"Tool Rule Id"}},"type":"object","required":["tool","tool_rule_id"],"title":"CatalogCrossReference","description":"One element of `CatalogRuleView.cross_references` (R-34, R-23,\nDecision 0040): one cross-reference of the rule to a rule of an\nexternal check tool, e.g. one of LintLang's `H`-identifiers -- the\nglossary's `rule_field` names `tool` (\"Werkzeugname\") and\n`tool_rule_id` (\"Regelkennung im Werkzeug\"), carried over unchanged\nfrom `a2a.engine.catalog.CrossReference`. No rule in any shipped\ncatalog version carries one yet, so every `cross_references` list in\nthe route's response is `[]` today; this model exists so a future\ncatalog version can add one without a route change."},"CatalogRuleView":{"properties":{"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"description":{"type":"string","title":"Description"},"check_logic":{"$ref":"#/components/schemas/CatalogCheckLogic"},"cross_references":{"items":{"$ref":"#/components/schemas/CatalogCrossReference"},"type":"array","title":"Cross References"},"report_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Report Count"},"operator_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Operator Count"},"owasp_asi":{"anyOf":[{"items":{"type":"string","enum":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI06","ASI07","ASI08","ASI09","ASI10"]},"type":"array"},{"type":"null"}],"title":"Owasp Asi"},"five_eyes_area":{"anyOf":[{"type":"string","enum":["privilege","design_and_configuration","behavioural","structural","accountability","none"]},{"type":"null"}],"title":"Five Eyes Area"},"standards_note":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Standards Note"},"owasp_ast":{"anyOf":[{"items":{"type":"string","enum":["AST01","AST02","AST03","AST04","AST05","AST06","AST07","AST08","AST09","AST10"]},"type":"array"},{"type":"null"}],"title":"Owasp Ast"}},"type":"object","required":["rule_id","rule_class","description","check_logic","cross_references","report_count","operator_count"],"title":"CatalogRuleView","description":"One element of `RuleCatalogView.rules`, the response body of `GET\n/v1/catalogs/{catalog_id}` for `catalog_id=\"rules\"` (R-23, Decision\n0040): identifier, description, check logic, rule class and\ncross-references -- exactly the five per-rule fields that item's own\ninstruction named, built straight from `a2a.engine.catalog.Rule`, which\ncarries no `operator_id`, `agent_id`, `report_id` or anything from\n`a2a.derivation` -- R-24's \"niemals ... Betreibernamen ... oder\nAgentennamen\" holds for those five by construction, not by a filter\napplied here.\n\n`report_count` and `operator_count` are R-23's \"Belegzahlen\" (queue\nitem 8b, Decision 0041; the glossary's `rule_field` names \"Anzahl\nBerichte\" and \"Anzahl Betreiber\"): the two counts frozen when the rule\nwas approved (R-26), read from the stored `a2a.derivation.Rule` of the\nsame `rule_id`. Both are numbers or both are `null`, never one of each.\n`null` is what a rule of the start catalog carries -- nothing was\napproved under its id, so it has no counts (concept.md: \"Regeln des\nStartkatalogs tragen keine\") -- and what a rule approved from fewer\nthan three operators would carry (R-24: \"jede Zahl auf mindestens drei\nBetreibern\"). They are the only two numbers this model holds, both\naggregates over reports; neither names an operator.\n\n`owasp_asi`, `five_eyes_area` and `standards_note` are the standards fields of MVP-R-95\n(point 90, catalogue 1.55.0 on): the OWASP ASI entries and the Five-Eyes risk area the rule\nanswers, and the note where either is empty. All three are `null` for a catalogue that\npredates them. `owasp_ast` is the field of MVP-R-125 (catalogue 1.84.0 on): the entries AST01 to\nAST10 of the OWASP Agentic Skills Top 10 the rule answers, empty where none fits; `null` for a\ncatalogue that predates it."},"ChangeAnchor":{"properties":{"kind":{"type":"string","enum":["field_path","quoted_line"],"title":"Kind"},"value":{"type":"string","title":"Value"}},"additionalProperties":false,"type":"object","required":["kind","value"],"title":"ChangeAnchor","description":"Where in the file a change applies (MVP-R-89): a `field_path` of a JSON file, or the\n`quoted_line`, the text as it stands in the file."},"ChangeEntry":{"properties":{"harness":{"type":"string","title":"Harness"},"harness_version":{"type":"string","title":"Harness Version"},"target":{"type":"string","enum":["file","choose"],"title":"Target"},"file":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"File"},"anchor":{"anyOf":[{"$ref":"#/components/schemas/ChangeAnchor"},{"type":"null"}]},"old":{"type":"string","title":"Old"},"new":{"type":"string","title":"New"},"rule_id":{"type":"string","title":"Rule Id"},"rule_version":{"type":"string","title":"Rule Version"},"finding_id":{"type":"string","title":"Finding Id"}},"additionalProperties":false,"type":"object","required":["harness","harness_version","target","file","anchor","old","new","rule_id","rule_version","finding_id"],"title":"ChangeEntry","description":"One change of the change list (MVP-R-89, schema `catalog/schema/change-list-1.0.0.json`):\nthe harness and the version of its structure table, the file inside the package (`null` with\n`target: choose` where the finding names none and the operator chooses one), the anchor (`null`\nfor an addition), the old content (empty for an addition), the new content (empty for a\nremoval), and the rule, its version and the finding it answers."},"ChangeStatus":{"type":"string","enum":["new","unresolved","resolved"],"title":"ChangeStatus"},"CheckPage":{"properties":{"checks":{"items":{"$ref":"#/components/schemas/CheckSummary"},"type":"array","title":"Checks"},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Next Cursor"}},"type":"object","required":["checks","next_cursor"],"title":"CheckPage","description":"The response body for `GET /v1/operator/checks` (MVP-R-04): the\noperator's checks, newest first, at most `limit` of them; `next_cursor` is\nthe opaque value to pass as `cursor` for the next page, `null` on the last\npage."},"CheckState":{"type":"string","enum":["received","filtered","checking","done","partial","failed"],"title":"CheckState"},"CheckStateView":{"properties":{"state":{"$ref":"#/components/schemas/StateName"},"check_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Check Id"},"completed_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Completed At"}},"type":"object","required":["state"],"title":"CheckStateView","description":"The response body for `GET /v1/agents/{agent_id}/check-state` (MVP-R-93, point 98): exactly one `state` for the\ncontent hash asked for, with the ID of the check that decides it and the time it finished where there is one (`fehlt`\nhas neither). The endpoint creates nothing."},"CheckSummary":{"properties":{"check_id":{"type":"string","title":"Check Id"},"agent_id":{"type":"string","title":"Agent Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"state":{"$ref":"#/components/schemas/CheckState"},"partial_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Partial Reason"},"received_at":{"type":"string","format":"date-time","title":"Received At"},"finished_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Finished At"},"trigger":{"type":"string","enum":["einreichung","katalog"],"title":"Trigger","default":"einreichung"}},"type":"object","required":["check_id","agent_id","data_class","state","partial_reason","received_at","finished_at"],"title":"CheckSummary","description":"One element of `CheckPage.checks`: a check without its transitions and\nfinding list (`GET /v1/checks/{check_id}` has them)."},"CheckTransitionView":{"properties":{"state":{"$ref":"#/components/schemas/CheckState"},"at":{"type":"string","format":"date-time","title":"At"}},"type":"object","required":["state","at"],"title":"CheckTransitionView","description":"One state a check passed through and when (MVP-R-03)."},"CheckType":{"type":"string","enum":["deterministic","model_based"],"title":"CheckType"},"CheckViewWithUsage":{"properties":{"check_id":{"type":"string","title":"Check Id"},"agent_id":{"type":"string","title":"Agent Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"state":{"$ref":"#/components/schemas/CheckState"},"partial_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Partial Reason"},"received_at":{"type":"string","format":"date-time","title":"Received At"},"finished_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Finished At"},"transitions":{"items":{"$ref":"#/components/schemas/CheckTransitionView"},"type":"array","title":"Transitions"},"package_version":{"type":"string","title":"Package Version"},"catalog_version":{"type":"string","title":"Catalog Version"},"adapter_versions":{"additionalProperties":{"type":"string"},"type":"object","title":"Adapter Versions"},"finding_list":{"anyOf":[{"$ref":"#/components/schemas/FindingListV11"},{"$ref":"#/components/schemas/FindingListV12"},{"$ref":"#/components/schemas/FindingListV13"},{"$ref":"#/components/schemas/FindingListV14"},{"$ref":"#/components/schemas/FindingListV15"},{"$ref":"#/components/schemas/FindingListV16"},{"$ref":"#/components/schemas/FindingListV17"},{"$ref":"#/components/schemas/FindingListV18"},{"$ref":"#/components/schemas/FindingListV19"},{"$ref":"#/components/schemas/FindingListV110"},{"$ref":"#/components/schemas/FindingListV111"},{"$ref":"#/components/schemas/FindingListV112"},{"$ref":"#/components/schemas/FindingListV113"},{"$ref":"#/components/schemas/FindingListV114"},{"type":"null"}],"title":"Finding List"},"recheck_of":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Recheck Of"},"addressed_finding_ids":{"items":{"type":"string"},"type":"array","title":"Addressed Finding Ids"},"comparison":{"items":{"$ref":"#/components/schemas/ComparisonPairView"},"type":"array","title":"Comparison"},"tool_changes":{"items":{"$ref":"#/components/schemas/ToolChangeView"},"type":"array","title":"Tool Changes"},"agent_card":{"anyOf":[{"$ref":"#/components/schemas/AgentCardView"},{"type":"null"}]},"trigger":{"type":"string","enum":["einreichung","katalog"],"title":"Trigger","default":"einreichung"},"plan":{"anyOf":[{"items":{"$ref":"#/components/schemas/PlanStepView"},"type":"array"},{"type":"null"}],"title":"Plan"},"limit_usage":{"items":{"$ref":"#/components/schemas/AccountUsageView"},"type":"array","title":"Limit Usage"}},"type":"object","required":["check_id","agent_id","data_class","state","partial_reason","received_at","finished_at","transitions","package_version","catalog_version","adapter_versions","finding_list"],"title":"CheckViewWithUsage","description":"`GET /v1/checks/{check_id}` (REST): the check view and the use of the account (MVP-R-38, DF-13), \"x of 75 this\nmonth\" and \"x of 5 today\", as the figures of the moment of the request. The finding list is unchanged and the\nMCP tool `get_check` keeps `CheckView`."},"ClassScore":{"properties":{"score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Score"},"applicable_rules":{"type":"integer","title":"Applicable Rules"}},"type":"object","required":["score","applicable_rules"],"title":"ClassScore"},"ComparisonPairView":{"properties":{"status":{"type":"string","title":"Status"},"prior_finding_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Prior Finding Id"},"finding_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Finding Id"}},"type":"object","required":["status","prior_finding_id","finding_id"],"title":"ComparisonPairView","description":"One pair of the comparison of a re-check with its referenced check\n(MVP-R-19, MVP-R-20). `status` is `open` (`prior_finding_id` equals\n`finding_id`), `resolved`, `not_recheckable` (the file or field of the prior\nfinding is absent from the new package; only `prior_finding_id`) or `new`\n(only `finding_id`)."},"ControlAction":{"type":"string","enum":["stop","restrict","take_over","trace"],"title":"ControlAction"},"CostBudgetChange":{"properties":{"cost_budget_cents":{"anyOf":[{"type":"integer","maximum":2147483647.0,"exclusiveMinimum":0.0},{"type":"null"}],"title":"Cost Budget Cents"}},"additionalProperties":false,"type":"object","required":["cost_budget_cents"],"title":"CostBudgetChange","description":"The request body for `PUT /v1/account/cost-budget` (R-43): the\nauthenticated operator's daily cost budget for model-supported checks,\n`cost_budget_cents`, a whole number of euro cents, or `null` to unset it\nagain. The default of every account is \"not set\", and R-43 is literal\nabout what that means: without a configured budget the service checks\ndeterministically only and marks every model-supported rule as skipped.\nA set budget is positive (`gt=0`): a budget of zero would be exhausted\nfrom its first cent and is not a configured budget, so it is answered\nwith a 422 rather than silently treated as one; `null` is the way to\nswitch model checks off again. And at most `MAX_COST_BUDGET_CENTS`\n(`a2a.storage`, the range of the `integer` column migration 009\ndeclares): a larger number is a 422 here, on both backends, never a\nPostgres out-of-range error turned into a 500 (Codex review of #59).\n\n`extra=\"forbid\"` for the same reason `SharingPolicyChange` and\nother request bodies declare it: a misspelled field name would otherwise\nbe dropped by Pydantic and the request would look successful while\nnothing about the account changed."},"CostBudgetView":{"properties":{"cost_budget_cents":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Cost Budget Cents"}},"type":"object","required":["cost_budget_cents"],"title":"CostBudgetView","description":"The response body for `PUT` and `GET /v1/account/cost-budget`\n(R-43): the account's daily cost budget in euro cents as stored\n(`operator.cost_budget_cents`, migration 009), `null` when none is\nset. Charging against the amount is not part of this response (queue\nitem 6c); it names the configured value, nothing about the day's\nspend."},"DataClass":{"type":"string","enum":["configuration","loop","memory_and_connections","failure_report","rule_contribution","questionnaire"],"title":"DataClass"},"EmailConfirmation":{"properties":{"token":{"type":"string","title":"Token"}},"additionalProperties":false,"type":"object","required":["token"],"title":"EmailConfirmation","description":"The request body for `POST /v1/account/email-confirmation` (MVP-R-37, MVP-R-40): the\ntoken (the code of the mail, or the `token` of its link)."},"EmailRegistration":{"properties":{"email":{"type":"string","title":"Email"}},"additionalProperties":false,"type":"object","required":["email"],"title":"EmailRegistration","description":"The request body for `POST /v1/account/email-registration` (MVP-R-37): the address to\nsend the confirmation link and code to."},"EmailRegistrationAccepted":{"properties":{"status":{"type":"string","const":"sent","title":"Status","default":"sent"},"valid_minutes":{"type":"integer","title":"Valid Minutes"}},"type":"object","required":["valid_minutes"],"title":"EmailRegistrationAccepted","description":"The answer to an accepted e-mail registration: the same for every address that is\naccepted, so it says nothing about whether the address had an account."},"ExternalObservation":{"properties":{"source":{"type":"string","title":"Source"},"date":{"type":"string","format":"date","title":"Date"},"statement":{"type":"string","title":"Statement"},"no_statement_about":{"type":"string","title":"No Statement About"}},"additionalProperties":false,"type":"object","required":["source","date","statement","no_statement_about"],"title":"ExternalObservation","description":"What a public registry said about the agent (MVP-R-30). The MVP fetches no\nregistry signal, so the list that holds these is always empty; the fields are\nreserved: where it came from, when, what it says, and what it makes no\nstatement about."},"Finding":{"properties":{"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"severity":{"$ref":"#/components/schemas/Severity"},"check_type":{"$ref":"#/components/schemas/CheckType"},"location":{"anyOf":[{"$ref":"#/components/schemas/Location"},{"type":"null"}]},"matched_text":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Matched Text"},"description":{"type":"string","title":"Description"},"suggestion":{"type":"string","title":"Suggestion"},"change_status":{"$ref":"#/components/schemas/ChangeStatus"},"previous_location":{"anyOf":[{"$ref":"#/components/schemas/Location"},{"type":"null"}]},"control_action":{"anyOf":[{"$ref":"#/components/schemas/ControlAction"},{"type":"null"}]},"match_index":{"type":"integer","title":"Match Index"},"counts_as_fixed":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Counts As Fixed"},"notice":{"type":"boolean","title":"Notice","default":false},"unjudged":{"type":"boolean","title":"Unjudged","default":false}},"type":"object","required":["rule_id","rule_class","severity","check_type","location","matched_text","description","suggestion","change_status","previous_location","control_action","match_index","counts_as_fixed"],"title":"Finding","description":"`location` and `matched_text` are null only for a `resolved` finding\n(R-17, `a2a.engine.comparison`): the condition is gone, so there is\nnothing left to point at, and `previous_location` carries where it used\nto be instead. `counts_as_fixed` is likewise set only on a `resolved`\nfinding (Review Paket 9a): `false` when the finding's `rule_id` is\nmissing from the finding list's own `catalog_version`, per concept.md's\n\"zählt aber nicht in die Kennzahl behobener Befunde\"; `null` on every\n`new` or `unresolved` finding, since no metric reads it there yet."},"FindingAcknowledged":{"properties":{"finding_id":{"type":"string","title":"Finding Id"},"acknowledged_check_ids":{"items":{"type":"string"},"type":"array","title":"Acknowledged Check Ids"}},"type":"object","required":["finding_id","acknowledged_check_ids"],"title":"FindingAcknowledged","description":"The response body of `POST /v1/operator/findings/{finding_id}/acknowledge`\n(MVP-R-21): the checks in which the escalation of the finding was cleared."},"FindingList":{"properties":{"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice","default":"This score measures static configuration checks for human control. It does not verify that controls work at runtime or that the agent is safe."},"score_scope":{"type":"string","enum":["static_configuration","self_declaration"],"title":"Score Scope","default":"static_configuration"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified","default":false},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/Finding"},"type":"array","title":"Findings"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcome"},"type":"array","title":"Rule Outcomes","default":[]},"score_cap":{"anyOf":[{"$ref":"#/components/schemas/ScoreCap"},{"type":"null"}]},"subscore_caps":{"anyOf":[{"items":{"$ref":"#/components/schemas/SubscoreCap"},"type":"array"},{"type":"null"}],"title":"Subscore Caps"},"submitted_through":{"anyOf":[{"type":"string","enum":["agent","web_interface"]},{"type":"null"}],"title":"Submitted Through"},"submitted_by_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Submitted By Account Id"},"not_judged":{"items":{"type":"string"},"type":"array","title":"Not Judged","default":[]},"language":{"anyOf":[{"type":"string","enum":["de","en"]},{"type":"null"}],"title":"Language"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitView"},"type":"array","title":"Assurance Limits","description":"MVP-R-65 (catalogue 1.29.0 on): the sentences that say what the result does not\nestablish, derived from the catalogue version of the list on every route that answers it\n(decision 0125); empty for a list of an earlier catalogue.","readOnly":true}},"type":"object","required":["submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","unknown_structure","skipped_rules","previous_submission_id","findings","assurance_limits"],"title":"FindingList"},"FindingListV11":{"properties":{"schema_version":{"type":"string","const":"1.1.0","title":"Schema Version","default":"1.1.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClass"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","const":"static_configuration","title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV1"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations"],"title":"FindingListV11","description":"The finding list in contract version 1.1.0 (MVP-R-30): version 1.0.0 and the\nreserved list `external_observations`, which stays empty. `1.0.0` and its schema\nfile stay as they are (a new version is a new file and a new model); what\n`GET /v1/checks/{id}` and the A2A artifact deliver is this one."},"FindingListV110":{"properties":{"schema_version":{"type":"string","const":"1.10.0","title":"Schema Version","default":"1.10.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","enum":["static_configuration","self_declaration"],"title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV14"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV15"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitV15"},"type":"array","title":"Assurance Limits"},"submitted_through":{"type":"string","enum":["agent","web_interface"],"title":"Submitted Through"},"submitted_by_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Submitted By Account Id"},"solution_tier":{"type":"string","enum":["free","premium"],"title":"Solution Tier"},"not_judged":{"items":{"$ref":"#/components/schemas/NotJudgedV110"},"type":"array","title":"Not Judged"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap","assurance_limits","submitted_through","submitted_by_account_id","solution_tier","not_judged"],"title":"FindingListV110","description":"The finding list in contract version 1.10.0 (MVP-R-128): version 1.9.0 with `not_judged`,\nthe areas the check could not judge from the package, each with its key and its German and\nEnglish sentence; the list changes no score. `1.9.0` and its schema file stay as they are."},"FindingListV111":{"properties":{"schema_version":{"type":"string","const":"1.11.0","title":"Schema Version","default":"1.11.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","enum":["static_configuration","self_declaration"],"title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV15"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV15"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitV15"},"type":"array","title":"Assurance Limits"},"submitted_through":{"type":"string","enum":["agent","web_interface"],"title":"Submitted Through"},"submitted_by_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Submitted By Account Id"},"solution_tier":{"type":"string","enum":["free","premium"],"title":"Solution Tier"},"not_judged":{"items":{"$ref":"#/components/schemas/NotJudgedV110"},"type":"array","title":"Not Judged"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap","assurance_limits","submitted_through","submitted_by_account_id","solution_tier","not_judged"],"title":"FindingListV111","description":"The finding list in contract version 1.11.0 (MVP-R-125): version 1.10.0 with `owasp_ast` on\nevery finding, for a list scored with a catalogue that declares `ast_fields` (1.84.0 on); the\nfield changes no score. `1.10.0` and its schema file stay as they are."},"FindingListV112":{"properties":{"schema_version":{"type":"string","const":"1.12.0","title":"Schema Version","default":"1.12.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","enum":["static_configuration","self_declaration"],"title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV16"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV15"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitV15"},"type":"array","title":"Assurance Limits"},"submitted_through":{"type":"string","enum":["agent","web_interface"],"title":"Submitted Through"},"submitted_by_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Submitted By Account Id"},"solution_tier":{"type":"string","enum":["free","premium"],"title":"Solution Tier"},"not_judged":{"items":{"$ref":"#/components/schemas/NotJudgedV110"},"type":"array","title":"Not Judged"},"language":{"type":"string","enum":["de","en"],"title":"Language"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap","assurance_limits","submitted_through","submitted_by_account_id","solution_tier","not_judged","language"],"title":"FindingListV112","description":"The finding list in contract version 1.12.0 (MVP-R-140): version 1.11.0 with `language`, the\nlanguage of the check (`de` or `en`), and `risk` and `self_check` on every finding in that\nlanguage, for a list scored with a catalogue that declares `self_check_texts` (1.87.0 on);\nnothing that is computed changes. `1.11.0` and its schema file stay as they are."},"FindingListV113":{"properties":{"schema_version":{"type":"string","const":"1.13.0","title":"Schema Version","default":"1.13.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","enum":["static_configuration","self_declaration"],"title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV16"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV15"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitV15"},"type":"array","title":"Assurance Limits"},"submitted_through":{"type":"string","enum":["agent","web_interface"],"title":"Submitted Through"},"submitted_by_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Submitted By Account Id"},"solution_tier":{"type":"string","enum":["free","premium"],"title":"Solution Tier"},"not_judged":{"items":{"$ref":"#/components/schemas/NotJudgedV110"},"type":"array","title":"Not Judged"},"language":{"type":"string","enum":["de","en"],"title":"Language"},"subscore_caps":{"items":{"$ref":"#/components/schemas/SubscoreCapV113"},"type":"array","title":"Subscore Caps"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap","assurance_limits","submitted_through","submitted_by_account_id","solution_tier","not_judged","language","subscore_caps"],"title":"FindingListV113","description":"The finding list in contract version 1.13.0 (MVP-R-132): version 1.12.0 with `subscore_caps`,\nevery class whose sub-score the cap of 70 for sentences alone lowered, with its uncapped value\nand the value 70 (empty where no class was capped), for a list scored with scoring 1.6.0\n(catalogue 1.92.0 on). The sub-scores in `class_scores` are the capped ones, and the total is\ncomputed from them. `1.12.0` and its schema file stay as they are."},"FindingListV114":{"properties":{"schema_version":{"type":"string","const":"1.14.0","title":"Schema Version","default":"1.14.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","enum":["static_configuration","self_declaration"],"title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV16"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV15"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitV15"},"type":"array","title":"Assurance Limits"},"submitted_through":{"type":"string","enum":["agent","web_interface"],"title":"Submitted Through"},"submitted_by_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Submitted By Account Id"},"solution_tier":{"type":"string","enum":["free","premium"],"title":"Solution Tier"},"not_judged":{"items":{"$ref":"#/components/schemas/NotJudgedV110"},"type":"array","title":"Not Judged"},"language":{"type":"string","enum":["de","en"],"title":"Language"},"subscore_caps":{"items":{"$ref":"#/components/schemas/SubscoreCapV113"},"type":"array","title":"Subscore Caps"},"groups":{"items":{"$ref":"#/components/schemas/GroupV114"},"type":"array","title":"Groups"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap","assurance_limits","submitted_through","submitted_by_account_id","solution_tier","not_judged","language","subscore_caps","groups"],"title":"FindingListV114","description":"The finding list in contract version 1.14.0 (MVP-R-135): version 1.13.0 with `groups`\n(empty where no rule has five findings of severity `hinweis` or `mittel`), for a list scored\nwith a catalogue that declares `finding_groups` (1.93.0 on). `1.13.0` and its schema file stay\nas they are."},"FindingListV12":{"properties":{"schema_version":{"type":"string","const":"1.2.0","title":"Schema Version","default":"1.2.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","const":"static_configuration","title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV12"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations"],"title":"FindingListV12","description":"The finding list in contract version 1.2.0 (MVP-R-34): version 1.1.0 with the rule\nclass `network` among the classes of the sub-scores and of the findings, for a list\nscored with scoring 1.3.0. `1.1.0` and its schema file stay as they are."},"FindingListV13":{"properties":{"schema_version":{"type":"string","const":"1.3.0","title":"Schema Version","default":"1.3.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","const":"static_configuration","title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV12"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV13"},"type":"array","title":"Rule Outcomes"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes"],"title":"FindingListV13","description":"The finding list in contract version 1.3.0 (MVP-R-59): version 1.2.0 and `rule_outcomes`,\nexactly one outcome per rule of its catalogue version that belongs to its data class. The\npublished scores can be recomputed from the outcomes and the published formula. `1.2.0` and\nits schema file stay as they are."},"FindingListV14":{"properties":{"schema_version":{"type":"string","const":"1.4.0","title":"Schema Version","default":"1.4.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","const":"static_configuration","title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV12"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV13"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap"],"title":"FindingListV14","description":"The finding list in contract version 1.4.0 (MVP-R-58): version 1.3.0 and `score_cap`, how\nthe capped total of scoring 1.4.0 came about (`total = min(mean_score, limit)`). `1.3.0` and\nits schema file stay as they are."},"FindingListV15":{"properties":{"schema_version":{"type":"string","const":"1.5.0","title":"Schema Version","default":"1.5.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","const":"static_configuration","title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV12"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV15"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitV15"},"type":"array","title":"Assurance Limits"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap","assurance_limits"],"title":"FindingListV15","description":"The finding list in contract version 1.5.0 (MVP-R-65, MVP-R-59): version 1.4.0, the outcome\nreasons of `RuleOutcomeV15` and `assurance_limits`, the sentences that say what the result does\nnot establish. `1.4.0` and its schema file stay as they are."},"FindingListV16":{"properties":{"schema_version":{"type":"string","const":"1.6.0","title":"Schema Version","default":"1.6.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","const":"static_configuration","title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV12"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV15"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitV15"},"type":"array","title":"Assurance Limits"},"submitted_through":{"type":"string","enum":["agent","web_interface"],"title":"Submitted Through"},"submitted_by_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Submitted By Account Id"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap","assurance_limits","submitted_through","submitted_by_account_id"],"title":"FindingListV16","description":"The finding list in contract version 1.6.0 (MVP-R-77): version 1.5.0 and how the package\ncame in: `submitted_through` is `agent` on every path that authenticates with the agent\ncredential and `web_interface` for the upload of a signed-in person, then with that account's\nid in `submitted_by_account_id`. `1.5.0` and its schema file stay as they are."},"FindingListV17":{"properties":{"schema_version":{"type":"string","const":"1.7.0","title":"Schema Version","default":"1.7.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","const":"static_configuration","title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV13"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV15"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitV15"},"type":"array","title":"Assurance Limits"},"submitted_through":{"type":"string","enum":["agent","web_interface"],"title":"Submitted Through"},"submitted_by_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Submitted By Account Id"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap","assurance_limits","submitted_through","submitted_by_account_id"],"title":"FindingListV17","description":"The finding list in contract version 1.7.0 (MVP-R-95): version 1.6.0 and `owasp_asi`,\n`five_eyes_area` and `standards_note` on every finding, for a list scored with a catalogue that\ndeclares `standards_fields` (1.55.0 on). `1.6.0` and its schema file stay as they are."},"FindingListV18":{"properties":{"schema_version":{"type":"string","const":"1.8.0","title":"Schema Version","default":"1.8.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","const":"static_configuration","title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV14"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV15"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitV15"},"type":"array","title":"Assurance Limits"},"submitted_through":{"type":"string","enum":["agent","web_interface"],"title":"Submitted Through"},"submitted_by_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Submitted By Account Id"},"solution_tier":{"type":"string","enum":["free","premium"],"title":"Solution Tier"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap","assurance_limits","submitted_through","submitted_by_account_id","solution_tier"],"title":"FindingListV18","description":"The finding list in contract version 1.8.0 (MVP-R-89): version 1.7.0 with `change_list` on\nevery finding and `solution_tier`, `premium` where the account had the paid tier when the\npackage came in (the change lists are delivered) and `free` otherwise (empty lists). `1.7.0`\nand its schema file stay as they are."},"FindingListV19":{"properties":{"schema_version":{"type":"string","const":"1.9.0","title":"Schema Version","default":"1.9.0"},"check_id":{"type":"string","title":"Check Id"},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"catalog_version":{"type":"string","title":"Catalog Version"},"scoring_version":{"type":"string","title":"Scoring Version"},"filter_version":{"type":"string","title":"Filter Version"},"overall_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Overall Score"},"class_scores":{"additionalProperties":{"$ref":"#/components/schemas/ClassScore"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Class Scores"},"controllability_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Controllability Score"},"action_scores":{"additionalProperties":{"$ref":"#/components/schemas/ActionScore"},"propertyNames":{"$ref":"#/components/schemas/ControlAction"},"type":"object","title":"Action Scores"},"controllability_omitted_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Controllability Omitted Reason"},"controllability_notice":{"type":"string","title":"Controllability Notice"},"score_scope":{"type":"string","enum":["static_configuration","self_declaration"],"title":"Score Scope"},"runtime_verified":{"type":"boolean","const":false,"title":"Runtime Verified"},"unknown_structure":{"items":{"type":"string"},"type":"array","title":"Unknown Structure"},"skipped_rules":{"items":{"type":"string"},"type":"array","title":"Skipped Rules"},"previous_submission_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Previous Submission Id"},"findings":{"items":{"$ref":"#/components/schemas/FindingV14"},"type":"array","title":"Findings"},"external_observations":{"items":{"$ref":"#/components/schemas/ExternalObservation"},"type":"array","title":"External Observations"},"rule_outcomes":{"items":{"$ref":"#/components/schemas/RuleOutcomeV15"},"type":"array","title":"Rule Outcomes"},"score_cap":{"$ref":"#/components/schemas/ScoreCap"},"assurance_limits":{"items":{"$ref":"#/components/schemas/AssuranceLimitV15"},"type":"array","title":"Assurance Limits"},"submitted_through":{"type":"string","enum":["agent","web_interface"],"title":"Submitted Through"},"submitted_by_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Submitted By Account Id"},"solution_tier":{"type":"string","enum":["free","premium"],"title":"Solution Tier"}},"additionalProperties":false,"type":"object","required":["check_id","submission_id","data_class","created_at","catalog_version","scoring_version","filter_version","overall_score","class_scores","controllability_score","action_scores","controllability_omitted_reason","controllability_notice","score_scope","runtime_verified","unknown_structure","skipped_rules","previous_submission_id","findings","external_observations","rule_outcomes","score_cap","assurance_limits","submitted_through","submitted_by_account_id","solution_tier"],"title":"FindingListV19","description":"The finding list in contract version 1.9.0 (MVP-R-106): version 1.8.0 with `score_scope`\nthat may also be `self_declaration`, which the list of the questionnaire of the Dots short\ncheck carries. A list of a package of files keeps `static_configuration`. `1.8.0` and its schema\nfile stay as they are."},"FindingStatus":{"type":"string","enum":["new","open","resolved","unclear","not_checkable","not_recheckable","escalated"],"title":"FindingStatus","description":"The finding statuses of MVP-R-05 (glossary `finding_status`). The own\ndeterministic rules produce `new`, `open` and `resolved`; the others are\nreserved for the steps that introduce them (re-check, escalation)."},"FindingV1":{"properties":{"finding_id":{"type":"string","title":"Finding Id"},"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClass"},"rule_version":{"type":"string","title":"Rule Version"},"check_type":{"$ref":"#/components/schemas/CheckType"},"control_action":{"anyOf":[{"$ref":"#/components/schemas/ControlAction"},{"type":"null"}]},"location":{"anyOf":[{"$ref":"#/components/schemas/Location"},{"type":"null"}]},"evidence":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Evidence"},"severity":{"$ref":"#/components/schemas/SeverityV1"},"proposal":{"type":"string","title":"Proposal"},"status":{"$ref":"#/components/schemas/FindingStatus"},"next_step":{"type":"string","title":"Next Step"},"provenance":{"items":{"oneOf":[{"$ref":"#/components/schemas/OwnProvenance"},{"$ref":"#/components/schemas/AgentCardProvenance"},{"$ref":"#/components/schemas/ToolProvenance"}],"discriminator":{"propertyName":"source","mapping":{"agent_card":"#/components/schemas/AgentCardProvenance","own":"#/components/schemas/OwnProvenance","tool":"#/components/schemas/ToolProvenance"}}},"type":"array","title":"Provenance"},"pattern_ids":{"items":{"type":"string"},"type":"array","title":"Pattern Ids"},"limits":{"items":{"type":"string"},"type":"array","title":"Limits"}},"additionalProperties":false,"type":"object","required":["finding_id","rule_id","rule_class","rule_version","check_type","control_action","location","evidence","severity","proposal","status","next_step","provenance","pattern_ids","limits"],"title":"FindingV1"},"FindingV12":{"properties":{"finding_id":{"type":"string","title":"Finding Id"},"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"rule_version":{"type":"string","title":"Rule Version"},"check_type":{"$ref":"#/components/schemas/CheckType"},"control_action":{"anyOf":[{"$ref":"#/components/schemas/ControlAction"},{"type":"null"}]},"location":{"anyOf":[{"$ref":"#/components/schemas/Location"},{"type":"null"}]},"evidence":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Evidence"},"severity":{"$ref":"#/components/schemas/SeverityV1"},"proposal":{"type":"string","title":"Proposal"},"status":{"$ref":"#/components/schemas/FindingStatus"},"next_step":{"type":"string","title":"Next Step"},"provenance":{"items":{"oneOf":[{"$ref":"#/components/schemas/OwnProvenance"},{"$ref":"#/components/schemas/AgentCardProvenance"},{"$ref":"#/components/schemas/ToolProvenance"}],"discriminator":{"propertyName":"source","mapping":{"agent_card":"#/components/schemas/AgentCardProvenance","own":"#/components/schemas/OwnProvenance","tool":"#/components/schemas/ToolProvenance"}}},"type":"array","title":"Provenance"},"pattern_ids":{"items":{"type":"string"},"type":"array","title":"Pattern Ids"},"limits":{"items":{"type":"string"},"type":"array","title":"Limits"}},"additionalProperties":false,"type":"object","required":["finding_id","rule_id","rule_class","rule_version","check_type","control_action","location","evidence","severity","proposal","status","next_step","provenance","pattern_ids","limits"],"title":"FindingV12","description":"A finding of contract version 1.2.0: the rule class may be `network`."},"FindingV13":{"properties":{"finding_id":{"type":"string","title":"Finding Id"},"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"rule_version":{"type":"string","title":"Rule Version"},"check_type":{"$ref":"#/components/schemas/CheckType"},"control_action":{"anyOf":[{"$ref":"#/components/schemas/ControlAction"},{"type":"null"}]},"location":{"anyOf":[{"$ref":"#/components/schemas/Location"},{"type":"null"}]},"evidence":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Evidence"},"severity":{"$ref":"#/components/schemas/SeverityV1"},"proposal":{"type":"string","title":"Proposal"},"status":{"$ref":"#/components/schemas/FindingStatus"},"next_step":{"type":"string","title":"Next Step"},"provenance":{"items":{"oneOf":[{"$ref":"#/components/schemas/OwnProvenance"},{"$ref":"#/components/schemas/AgentCardProvenance"},{"$ref":"#/components/schemas/ToolProvenance"}],"discriminator":{"propertyName":"source","mapping":{"agent_card":"#/components/schemas/AgentCardProvenance","own":"#/components/schemas/OwnProvenance","tool":"#/components/schemas/ToolProvenance"}}},"type":"array","title":"Provenance"},"pattern_ids":{"items":{"type":"string"},"type":"array","title":"Pattern Ids"},"limits":{"items":{"type":"string"},"type":"array","title":"Limits"},"owasp_asi":{"items":{"type":"string","enum":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI06","ASI07","ASI08","ASI09","ASI10"]},"type":"array","title":"Owasp Asi"},"five_eyes_area":{"type":"string","enum":["privilege","design_and_configuration","behavioural","structural","accountability","none"],"title":"Five Eyes Area"},"standards_note":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Standards Note"}},"additionalProperties":false,"type":"object","required":["finding_id","rule_id","rule_class","rule_version","check_type","control_action","location","evidence","severity","proposal","status","next_step","provenance","pattern_ids","limits","owasp_asi","five_eyes_area","standards_note"],"title":"FindingV13","description":"A finding of contract version 1.7.0 (MVP-R-95): the OWASP ASI entries and the Five-Eyes risk\narea of its rule, and the note where either is empty. The values are those of the rule in its\ncatalogue version, so they are fixed with the rule; a finding of an earlier contract version has\nnone of them."},"FindingV14":{"properties":{"finding_id":{"type":"string","title":"Finding Id"},"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"rule_version":{"type":"string","title":"Rule Version"},"check_type":{"$ref":"#/components/schemas/CheckType"},"control_action":{"anyOf":[{"$ref":"#/components/schemas/ControlAction"},{"type":"null"}]},"location":{"anyOf":[{"$ref":"#/components/schemas/Location"},{"type":"null"}]},"evidence":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Evidence"},"severity":{"$ref":"#/components/schemas/SeverityV1"},"proposal":{"type":"string","title":"Proposal"},"status":{"$ref":"#/components/schemas/FindingStatus"},"next_step":{"type":"string","title":"Next Step"},"provenance":{"items":{"oneOf":[{"$ref":"#/components/schemas/OwnProvenance"},{"$ref":"#/components/schemas/AgentCardProvenance"},{"$ref":"#/components/schemas/ToolProvenance"}],"discriminator":{"propertyName":"source","mapping":{"agent_card":"#/components/schemas/AgentCardProvenance","own":"#/components/schemas/OwnProvenance","tool":"#/components/schemas/ToolProvenance"}}},"type":"array","title":"Provenance"},"pattern_ids":{"items":{"type":"string"},"type":"array","title":"Pattern Ids"},"limits":{"items":{"type":"string"},"type":"array","title":"Limits"},"owasp_asi":{"items":{"type":"string","enum":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI06","ASI07","ASI08","ASI09","ASI10"]},"type":"array","title":"Owasp Asi"},"five_eyes_area":{"type":"string","enum":["privilege","design_and_configuration","behavioural","structural","accountability","none"],"title":"Five Eyes Area"},"standards_note":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Standards Note"},"change_list":{"items":{"$ref":"#/components/schemas/ChangeEntry"},"type":"array","title":"Change List"}},"additionalProperties":false,"type":"object","required":["finding_id","rule_id","rule_class","rule_version","check_type","control_action","location","evidence","severity","proposal","status","next_step","provenance","pattern_ids","limits","owasp_asi","five_eyes_area","standards_note","change_list"],"title":"FindingV14","description":"A finding of contract version 1.8.0 (MVP-R-89): its change list, the entries of the paid\ntier; empty for an account of the free tier, for a rule without a deterministic change and for\na finding of severity `info`."},"FindingV15":{"properties":{"finding_id":{"type":"string","title":"Finding Id"},"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"rule_version":{"type":"string","title":"Rule Version"},"check_type":{"$ref":"#/components/schemas/CheckType"},"control_action":{"anyOf":[{"$ref":"#/components/schemas/ControlAction"},{"type":"null"}]},"location":{"anyOf":[{"$ref":"#/components/schemas/Location"},{"type":"null"}]},"evidence":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Evidence"},"severity":{"$ref":"#/components/schemas/SeverityV1"},"proposal":{"type":"string","title":"Proposal"},"status":{"$ref":"#/components/schemas/FindingStatus"},"next_step":{"type":"string","title":"Next Step"},"provenance":{"items":{"oneOf":[{"$ref":"#/components/schemas/OwnProvenance"},{"$ref":"#/components/schemas/AgentCardProvenance"},{"$ref":"#/components/schemas/ToolProvenance"}],"discriminator":{"propertyName":"source","mapping":{"agent_card":"#/components/schemas/AgentCardProvenance","own":"#/components/schemas/OwnProvenance","tool":"#/components/schemas/ToolProvenance"}}},"type":"array","title":"Provenance"},"pattern_ids":{"items":{"type":"string"},"type":"array","title":"Pattern Ids"},"limits":{"items":{"type":"string"},"type":"array","title":"Limits"},"owasp_asi":{"items":{"type":"string","enum":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI06","ASI07","ASI08","ASI09","ASI10"]},"type":"array","title":"Owasp Asi"},"five_eyes_area":{"type":"string","enum":["privilege","design_and_configuration","behavioural","structural","accountability","none"],"title":"Five Eyes Area"},"standards_note":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Standards Note"},"change_list":{"items":{"$ref":"#/components/schemas/ChangeEntry"},"type":"array","title":"Change List"},"owasp_ast":{"items":{"type":"string","enum":["AST01","AST02","AST03","AST04","AST05","AST06","AST07","AST08","AST09","AST10"]},"type":"array","title":"Owasp Ast"}},"additionalProperties":false,"type":"object","required":["finding_id","rule_id","rule_class","rule_version","check_type","control_action","location","evidence","severity","proposal","status","next_step","provenance","pattern_ids","limits","owasp_asi","five_eyes_area","standards_note","change_list","owasp_ast"],"title":"FindingV15","description":"A finding of contract version 1.11.0 (MVP-R-125): the entries of the OWASP Agentic Skills\nTop 10 its rule answers, empty where none fits. The entries are those of the rule in its\ncatalogue version; a finding of an earlier contract version has none."},"FindingV16":{"properties":{"finding_id":{"type":"string","title":"Finding Id"},"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"rule_version":{"type":"string","title":"Rule Version"},"check_type":{"$ref":"#/components/schemas/CheckType"},"control_action":{"anyOf":[{"$ref":"#/components/schemas/ControlAction"},{"type":"null"}]},"location":{"anyOf":[{"$ref":"#/components/schemas/Location"},{"type":"null"}]},"evidence":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Evidence"},"severity":{"$ref":"#/components/schemas/SeverityV1"},"proposal":{"type":"string","title":"Proposal"},"status":{"$ref":"#/components/schemas/FindingStatus"},"next_step":{"type":"string","title":"Next Step"},"provenance":{"items":{"oneOf":[{"$ref":"#/components/schemas/OwnProvenance"},{"$ref":"#/components/schemas/AgentCardProvenance"},{"$ref":"#/components/schemas/ToolProvenance"}],"discriminator":{"propertyName":"source","mapping":{"agent_card":"#/components/schemas/AgentCardProvenance","own":"#/components/schemas/OwnProvenance","tool":"#/components/schemas/ToolProvenance"}}},"type":"array","title":"Provenance"},"pattern_ids":{"items":{"type":"string"},"type":"array","title":"Pattern Ids"},"limits":{"items":{"type":"string"},"type":"array","title":"Limits"},"owasp_asi":{"items":{"type":"string","enum":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI06","ASI07","ASI08","ASI09","ASI10"]},"type":"array","title":"Owasp Asi"},"five_eyes_area":{"type":"string","enum":["privilege","design_and_configuration","behavioural","structural","accountability","none"],"title":"Five Eyes Area"},"standards_note":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Standards Note"},"change_list":{"items":{"$ref":"#/components/schemas/ChangeEntry"},"type":"array","title":"Change List"},"owasp_ast":{"items":{"type":"string","enum":["AST01","AST02","AST03","AST04","AST05","AST06","AST07","AST08","AST09","AST10"]},"type":"array","title":"Owasp Ast"},"risk":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Risk"},"self_check":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Self Check"}},"additionalProperties":false,"type":"object","required":["finding_id","rule_id","rule_class","rule_version","check_type","control_action","location","evidence","severity","proposal","status","next_step","provenance","pattern_ids","limits","owasp_asi","five_eyes_area","standards_note","change_list","owasp_ast","risk","self_check"],"title":"FindingV16","description":"A finding of contract version 1.12.0 (MVP-R-140): the two sentences of its rule in the\nlanguage of the list (`FindingListV112.language`): `risk`, why the setting is risky for the\nperson's work, and `self_check`, how a person finds and judges the same setting in their own\nfiles without the service. They are those of the rule in its catalogue version; `null` for a\nfinding that no rule of the catalogue stands behind (the Agent Card rules, an external\nchecker). They change no score, outcome or `finding_id`."},"FindingVerdictBody":{"properties":{"verdict":{"type":"string","enum":["zutreffend","fehlalarm","nicht_anwendbar","unklar"],"title":"Verdict"}},"additionalProperties":false,"type":"object","required":["verdict"],"title":"FindingVerdictBody","description":"The request body of `PUT /v1/operator/findings/{finding_id}/verdict` (MVP-R-79): one of the\nfour verdicts; any other value is a 422."},"FindingVerdictView":{"properties":{"finding_id":{"type":"string","title":"Finding Id"},"verdict":{"anyOf":[{"type":"string","enum":["zutreffend","fehlalarm","nicht_anwendbar","unklar"]},{"type":"null"}],"title":"Verdict"},"set_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Set At"}},"type":"object","required":["finding_id","verdict","set_at"],"title":"FindingVerdictView","description":"The verdict of a finding and the time of its latest setting (MVP-R-79); `verdict` and\n`set_at` are `null` while the operator has recorded none."},"FunnelStep":{"type":"string","enum":["mcp_sign_in","first_grant","first_check","first_recheck","limit_refused","premium_booked","premium_ended","copy_clicked","first_check_shown"],"title":"FunnelStep"},"GroupMemberV114":{"properties":{"finding_id":{"type":"string","title":"Finding Id"},"location":{"anyOf":[{"$ref":"#/components/schemas/Location"},{"type":"null"}]}},"additionalProperties":false,"type":"object","required":["finding_id","location"],"title":"GroupMemberV114","description":"One finding of a group (MVP-R-135): its `finding_id` and its location. The finding keeps its\nstatus, verdict (R-79) and comparison (R-19) in `findings`."},"GroupV114":{"properties":{"rule_id":{"type":"string","title":"Rule Id"},"severity":{"type":"string","title":"Severity"},"number":{"type":"integer","title":"Number"},"members":{"items":{"$ref":"#/components/schemas/GroupMemberV114"},"type":"array","title":"Members"}},"additionalProperties":false,"type":"object","required":["rule_id","severity","number","members"],"title":"GroupV114","description":"Five or more findings of the same rule with severity `hinweis` or `mittel` (MVP-R-135): the\nrule, the severity, the number and every member. The members stay findings of their own; the\nscores, the pilot report and the metrics count them as before."},"GuardCountEntry":{"properties":{"day":{"type":"string","format":"date","title":"Day"},"rule_id":{"type":"string","pattern":"^[A-Za-z][A-Za-z0-9_-]{0,39}$","title":"Rule Id"},"decision":{"type":"string","enum":["ask","deny","warn"],"title":"Decision"},"hits":{"type":"integer","maximum":1000000.0,"minimum":1.0,"title":"Hits"}},"additionalProperties":false,"type":"object","required":["day","rule_id","decision","hits"],"title":"GuardCountEntry","description":"One number of the guard (MVP-R-142): on the UTC `day` the rule `rule_id` hit `hits` times and was decided as `decision`\n(`ask`, `deny` or `warn`). The number is absolute and replaces the earlier one of the same day, rule and decision. There is\nno field for a command, a path, a URL, a result or a session ID."},"GuardCountsRequest":{"properties":{"counts":{"items":{"$ref":"#/components/schemas/GuardCountEntry"},"type":"array","maxItems":200,"minItems":1,"title":"Counts"}},"additionalProperties":false,"type":"object","required":["counts"],"title":"GuardCountsRequest","description":"The request body for `POST /v1/agents/{agent_id}/guard-counts` (MVP-R-142): at most 200 numbers."},"GuardCountsStored":{"properties":{"stored":{"type":"integer","title":"Stored"}},"type":"object","required":["stored"],"title":"GuardCountsStored"},"GuardWeekView":{"properties":{"week":{"type":"string","title":"Week"},"rule_id":{"type":"string","title":"Rule Id"},"decision":{"type":"string","title":"Decision"},"hits":{"type":"integer","title":"Hits"}},"type":"object","required":["week","rule_id","decision","hits"],"title":"GuardWeekView"},"GuardWeeksView":{"properties":{"weeks":{"items":{"$ref":"#/components/schemas/GuardWeekView"},"type":"array","title":"Weeks"}},"type":"object","required":["weeks"],"title":"GuardWeeksView","description":"The response body for `GET /v1/agents/{agent_id}/guard-counts` (MVP-R-142): per ISO week, rule and decision the hits, newest\nweek first, kept 90 days."},"HTTPValidationError":{"properties":{"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"type":"array","title":"Detail"}},"type":"object","title":"HTTPValidationError"},"InvitationConfirmation":{"properties":{"token":{"type":"string","title":"Token"}},"additionalProperties":false,"type":"object","required":["token"],"title":"InvitationConfirmation","description":"The request body for `POST /v1/account/members/invitations/confirmation` (MVP-R-88): the\ntoken (the code of the mail, or the `token` of its link)."},"InvitationWithdrawn":{"properties":{"invitation_id":{"type":"string","title":"Invitation Id"}},"type":"object","required":["invitation_id"],"title":"InvitationWithdrawn","description":"The answer of `DELETE /v1/account/members/invitations/{invitation_id}`."},"LimitUsage":{"properties":{"limit":{"type":"string","title":"Limit"},"period":{"type":"string","enum":["total","utc_day","utc_month"],"title":"Period"},"maximum":{"type":"integer","title":"Maximum"},"used":{"type":"integer","title":"Used"},"rest":{"type":"integer","title":"Rest"}},"type":"object","required":["limit","period","maximum","used","rest"],"title":"LimitUsage","description":"One numeric limit of the account with its period, its use within the current period and its\nrest (point 111, MVP-R-110)."},"Location":{"properties":{"file":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"File"},"line":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Line"},"field_path":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Field Path"}},"type":"object","title":"Location"},"McpGrantList":{"properties":{"grants":{"items":{"$ref":"#/components/schemas/McpGrantView"},"type":"array","title":"Grants"}},"type":"object","required":["grants"],"title":"McpGrantList"},"McpGrantRevoked":{"properties":{"grant_id":{"type":"string","title":"Grant Id"},"revoked_at":{"type":"string","format":"date-time","title":"Revoked At"}},"type":"object","required":["grant_id","revoked_at"],"title":"McpGrantRevoked","description":"The answer of `DELETE /v1/account/mcp-grants/{grant_id}`."},"McpGrantView":{"properties":{"grant_id":{"type":"string","title":"Grant Id"},"client_name":{"type":"string","title":"Client Name"},"approved_by":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Approved By"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"last_used_at":{"type":"string","format":"date-time","title":"Last Used At"},"revoked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Revoked At"},"revoked_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Revoked Reason"}},"type":"object","required":["grant_id","client_name","created_at","last_used_at"],"title":"McpGrantView","description":"One grant in `GET /v1/account/mcp-grants` (MVP-R-52): the client as it named itself, the\naddress that approved it (the owner address or a member address), never a token."},"MemberInvitationAccepted":{"properties":{"status":{"type":"string","const":"sent","title":"Status","default":"sent"},"valid_days":{"type":"integer","title":"Valid Days"}},"type":"object","required":["valid_days"],"title":"MemberInvitationAccepted","description":"The answer to an accepted invitation: a link and code went to the address; `valid_days` is\nhow long they work (seven)."},"MemberInvitationRequest":{"properties":{"email":{"type":"string","title":"Email"}},"additionalProperties":false,"type":"object","required":["email"],"title":"MemberInvitationRequest","description":"The request body for `POST /v1/account/members/invitations` (MVP-R-88): the address of the\ncolleague to invite, an address of the domain of the owner address."},"MemberInvitationView":{"properties":{"invitation_id":{"type":"string","title":"Invitation Id"},"email":{"type":"string","title":"Email"},"sent_at":{"type":"string","format":"date-time","title":"Sent At"},"expires_at":{"type":"string","format":"date-time","title":"Expires At"}},"type":"object","required":["invitation_id","email","sent_at","expires_at"],"title":"MemberInvitationView","description":"An open invitation in `GET /v1/account/members` (MVP-R-88); never the token."},"MemberJoined":{"properties":{"email":{"type":"string","title":"Email"},"owner":{"type":"string","title":"Owner"}},"type":"object","required":["email","owner"],"title":"MemberJoined","description":"The answer to a confirmed invitation: the address is a member of the account of `owner`.\nIt shows no key and creates none."},"MemberList":{"properties":{"members":{"items":{"$ref":"#/components/schemas/MemberView"},"type":"array","title":"Members"},"invitations":{"items":{"$ref":"#/components/schemas/MemberInvitationView"},"type":"array","title":"Invitations"}},"type":"object","required":["members","invitations"],"title":"MemberList","description":"The members of the account and its open invitations (MVP-R-88)."},"MemberRemoved":{"properties":{"member_id":{"type":"string","title":"Member Id"}},"type":"object","required":["member_id"],"title":"MemberRemoved","description":"The answer of `DELETE /v1/account/members/{member_id}`: the member is gone, its web\nsessions have ended and the grants it approved are revoked (MVP-R-88, MVP-R-52)."},"MemberView":{"properties":{"member_id":{"type":"string","title":"Member Id"},"email":{"type":"string","title":"Email"},"joined_at":{"type":"string","format":"date-time","title":"Joined At"}},"type":"object","required":["member_id","email","joined_at"],"title":"MemberView","description":"A member in `GET /v1/account/members` (MVP-R-88): the address and the time of joining."},"MetricsSnapshot":{"properties":{"active_agents":{"type":"integer","title":"Active Agents"},"active_operators":{"type":"integer","title":"Active Operators"},"weekly_submissions":{"items":{"$ref":"#/components/schemas/WeeklySubmissionCount"},"type":"array","title":"Weekly Submissions"},"resolved_share":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Resolved Share"},"published_rules":{"additionalProperties":{"type":"integer"},"propertyNames":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"type":"object","title":"Published Rules"},"checks_per_state":{"additionalProperties":{"type":"integer"},"propertyNames":{"$ref":"#/components/schemas/CheckState"},"type":"object","title":"Checks Per State"},"recheck_resolved_share":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Recheck Resolved Share"},"median_hours_new_to_resolved":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Median Hours New To Resolved"},"escalations":{"type":"integer","title":"Escalations","default":0},"measurement_reports":{"additionalProperties":{"additionalProperties":{"type":"number"},"type":"object"},"type":"object","title":"Measurement Reports"},"weekly_steps":{"items":{"$ref":"#/components/schemas/WeeklyStepCount"},"type":"array","title":"Weekly Steps"},"weekly_skipped_checks":{"items":{"$ref":"#/components/schemas/WeeklySkippedCount"},"type":"array","title":"Weekly Skipped Checks"}},"type":"object","required":["active_agents","active_operators","weekly_submissions","resolved_share","published_rules"],"title":"MetricsSnapshot","description":"The response body for `GET /v1/internal/metrics` (R-30), internal\nonly (Decision 0027's static shared-secret check, `a2a/api/app.py`).\nField names are the glossary's own `metrics_field` group\n(`catalog/glossary.yaml`): `active_agents`, `active_operators`,\n`weekly_submissions`, `resolved_share`, `published_rules` -- none\ninvented here. Every field is an aggregated count or ratio; nothing here\nis, or contains, a raw submission, a finding, an `agent_id`, an\n`operator_id` or an operator name (R-24's \"nie ... Betreibernamen\"\ncarried over to this endpoint's own instruction)."},"NotJudgedV110":{"properties":{"key":{"type":"string","enum":["netzwerk","befugnis","hooks"],"title":"Key"},"de":{"type":"string","title":"De"},"en":{"type":"string","title":"En"}},"additionalProperties":false,"type":"object","required":["key","de","en"],"title":"NotJudgedV110","description":"One area the check could not judge from the package (MVP-R-128): its stable key and both\nsentences of the catalogue file of MVP-R-65."},"OperatorRequestRejected":{"properties":{"reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Reason"},"message":{"type":"string","title":"Message"},"detail":{"additionalProperties":true,"type":"object","title":"Detail"}},"type":"object","required":["message"],"title":"OperatorRequestRejected","description":"The unified error body for the operator- and sharing-policy routes\nbelow (401/403/400/404) -- one shape for every refusal there, the same\nway `SubmissionRejected` is one shape for the agent endpoints, not a\ndifferent one per status code.\n\n`reason` covers two different sources under one name: the `RejectionReason`\nvalue of an `AccountService.authenticate` refusal (`token_invalid`,\n`domain_unverified`), or the `RejectionCode` value of an `AgentError`\nthat came from `a2a.agents.validation` (`name_length`, `tags_too_many`,\nand so on -- see `a2a.agents.validation.RejectionCode`). The two enums\nare unrelated types with disjoint value sets, so `reason` is a bare\n`str`, not typed to either; `None` when nothing machine-readable applies\n(a duplicate agent name, \"no such agent\", or a `PolicyError` -- `message`\nalone says why in those cases)."},"OwnProvenance":{"properties":{"source":{"type":"string","const":"own","title":"Source"}},"additionalProperties":false,"type":"object","required":["source"],"title":"OwnProvenance","description":"A deterministic rule of the catalogue."},"OwnerAddressConfirmation":{"properties":{"code":{"type":"string","title":"Code"}},"additionalProperties":false,"type":"object","required":["code"],"title":"OwnerAddressConfirmation","description":"The request body for `POST /v1/account/owner-address/confirmation` (MVP-R-100): the code of\nthe mail, used together with the account key."},"OwnerAddressConfirmed":{"properties":{"operator_id":{"type":"string","title":"Operator Id"},"email":{"type":"string","title":"Email"}},"type":"object","required":["operator_id","email"],"title":"OwnerAddressConfirmed","description":"The answer to a confirmed owner address: the account and its owner address. Nothing else of\nthe account changed (MVP-R-100)."},"OwnerAddressRequest":{"properties":{"email":{"type":"string","title":"Email"}},"additionalProperties":false,"type":"object","required":["email"],"title":"OwnerAddressRequest","description":"The request body for `POST /v1/account/owner-address` (MVP-R-100): an address of the\nproven domain of an account made by the former domain proof."},"PatternCatalogView":{"properties":{"catalog_version":{"type":"string","title":"Catalog Version"},"links_version":{"type":"string","title":"Links Version"},"license":{"type":"string","title":"License"},"patterns":{"items":{"$ref":"#/components/schemas/PatternView"},"type":"array","title":"Patterns"}},"type":"object","required":["catalog_version","links_version","license","patterns"],"title":"PatternCatalogView","description":"The response body for `GET /v1/catalog/patterns` (MVP-R-17): the versioned\npattern catalogue, its `catalog_version`, the version of the rule links\n(`links_version`) and the fixed `license`, `CC-BY-4.0`, like the rule\ncatalogue. Two requests answer byte-identical JSON."},"PatternSourceView":{"properties":{"title":{"type":"string","title":"Title"},"url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Url"}},"type":"object","required":["title","url"],"title":"PatternSourceView","description":"Where a pattern's practice comes from (MVP-R-15): the title of the\ndocument and, when there is one, its address."},"PatternView":{"properties":{"pattern_id":{"type":"string","title":"Pattern Id"},"version":{"type":"string","title":"Version"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"title":{"type":"string","title":"Title"},"rationale":{"type":"string","title":"Rationale"},"before":{"type":"string","title":"Before"},"after":{"type":"string","title":"After"},"source":{"$ref":"#/components/schemas/PatternSourceView"},"rule_ids":{"items":{"type":"string"},"type":"array","title":"Rule Ids"}},"type":"object","required":["pattern_id","version","rule_class","title","rationale","before","after","source","rule_ids"],"title":"PatternView","description":"One pattern of the public catalogue (MVP-R-15, MVP-R-17): `pattern_id`,\n`version`, the `rule_class` it belongs to, a `title`, a short `rationale`, a\n`before` and an `after` example, the `source` of the practice and the ids of\nthe rules that link to it (`rule_ids`, from the rule-to-pattern links of\nMVP-R-16). Nothing here names an operator, an agent or a report."},"PilotReport":{"properties":{"schema_version":{"type":"string","const":"1.0.0","title":"Schema Version","default":"1.0.0"},"range":{"$ref":"#/components/schemas/ReportRange"},"checks_per_state":{"additionalProperties":{"type":"integer"},"type":"object","title":"Checks Per State"},"findings_per_class":{"additionalProperties":{"type":"integer"},"type":"object","title":"Findings Per Class"},"findings_per_rule":{"items":{"$ref":"#/components/schemas/RuleCount"},"type":"array","title":"Findings Per Rule"},"verdicts":{"$ref":"#/components/schemas/VerdictCounts"},"findings_without_verdict":{"type":"integer","title":"Findings Without Verdict"},"behoben_neu_pairs":{"items":{"$ref":"#/components/schemas/BehobenNeuPair"},"type":"array","title":"Behoben Neu Pairs"},"rechecks":{"$ref":"#/components/schemas/RecheckCounts"}},"additionalProperties":false,"type":"object","required":["range","checks_per_state","findings_per_class","findings_per_rule","verdicts","findings_without_verdict","behoben_neu_pairs","rechecks"],"title":"PilotReport"},"PlanStepView":{"properties":{"step":{"type":"integer","title":"Step"},"severity":{"type":"string","enum":["high","medium","info"],"title":"Severity"},"finding_ids":{"items":{"type":"string"},"type":"array","title":"Finding Ids"},"predicted_total_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Predicted Total Score"}},"type":"object","required":["step","severity","finding_ids","predicted_total_score"],"title":"PlanStepView","description":"One step of the plan of a check (MVP-R-91, point 96): `step` is its number, the number the\npage and the summary name; `severity` the highest severity of the findings still open in it\n(`high`, `medium`, `info`); `finding_ids` those findings; `predicted_total_score` the total\nscore after this step and every step before it, computed by the published formula from the\noutcomes of the list with the rules of those findings taken as met. It is a prediction and\nchanges no score and no status; it is `null` for an account of the free tier (the steps are the\nsame) and where the list does not recompute (no outcomes, or a total that differs from the\npublished one)."},"PolicyValue":{"type":"string","enum":["allowed","blocked"],"title":"PolicyValue"},"ProvenanceRecordView":{"properties":{"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClass"},"check_type":{"$ref":"#/components/schemas/CheckType"},"report_ids":{"items":{"type":"string"},"type":"array","title":"Report Ids"}},"type":"object","required":["rule_id","rule_class","check_type","report_ids"],"title":"ProvenanceRecordView","description":"One element of the response body for `GET /v1/operator/rules` (R-22,\nDecision 0039): one rule the authenticated operator's failure reports\nfed into, and which of that operator's reports did -- the glossary's\n`provenance_record` (`derivation_term`, \"Herkunftsnachweis\"). `rule_id`,\n`rule_class` and `check_type` are the `rule_field` names of the rule\nitself (`a2a.derivation.Rule`); `report_ids` are the `report_id`s of\n`a2a.derivation.ProvenanceEntry`, the `submission_id` each failure\nreport was accepted under, and only those entries that name the\nrequesting operator. Nothing here is, or contains, another operator's\nreport, an `operator_id`, the rule's counts or any content of a report\n(R-21: \"aber keinen Inhalt eines einzelnen Berichts\")."},"RecheckCounts":{"properties":{"rechecks":{"type":"integer","title":"Rechecks"},"behoben":{"type":"integer","title":"Behoben"},"offen":{"type":"integer","title":"Offen"},"nicht_erneut_pruefbar":{"type":"integer","title":"Nicht Erneut Pruefbar"},"neu":{"type":"integer","title":"Neu"}},"additionalProperties":false,"type":"object","required":["rechecks","behoben","offen","nicht_erneut_pruefbar","neu"],"title":"RecheckCounts"},"RedactionInfo":{"properties":{"file":{"type":"string","title":"File"},"line":{"type":"integer","title":"Line"}},"type":"object","required":["file","line"],"title":"RedactionInfo","description":"One replaced hit (R-10): `file` and `line`, the glossary's\n`filter_response_field` group. `pattern_id` and `placeholder`\n(`a2a.intake.models.Redaction`) are the filter's own internal detail, not\nnamed by R-10's response contract, so they stay out of this response."},"RegistrationOutcome":{"type":"string","enum":["registered","key_replaced"],"title":"RegistrationOutcome","description":"What a successful proof did.\n\n`key_replaced` matters to the caller: they proved a domain that already has\nan account, so they did not get a new one. It is also the way back in after\nlosing an account key, since reissuing needs the old key."},"RejectionReason":{"type":"string","enum":["data_class_blocked","unsupported_harness","unsupported_format","harness_mismatch","schema_invalid","credentials_found","too_large","archive_invalid","duplicate","rate_limited","token_invalid","domain_unverified","redaction_broke_file","account_limit","account_key_required","owner_required","account_suspended","fresh_sign_in_required"],"title":"RejectionReason","description":"Machine-readable rejection reasons.\n\nThe concept states the reasons in prose; the codes are an addition, listed\nin claude/haertungsloop-sammlung.md, because the acceptance cases assert\nthem."},"ReminderChange":{"properties":{"enabled":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Enabled"},"period_days":{"anyOf":[{"type":"integer","maximum":90.0,"minimum":7.0},{"type":"null"}],"title":"Period Days"}},"additionalProperties":false,"type":"object","title":"ReminderChange","description":"The request body for `PUT /v1/account/reminders` (MVP-R-115): the reminder mail of the paid tier. `enabled` turns the\nreminders of the account on or off, `period_days` (7 to 90) sets how old the last check of an agent may be before it\nis reminded. A field that is left out keeps its value; at least one is needed. The default of every account is on, 30 days."},"ReminderOffRequest":{"properties":{"token":{"type":"string","maxLength":200,"minLength":20,"pattern":"^[A-Za-z0-9_-]+$","title":"Token"}},"additionalProperties":false,"type":"object","required":["token"],"title":"ReminderOffRequest","description":"The request body for `POST /v1/reminders/off` (MVP-R-115): the token of the link in a reminder mail. The link turns the\nreminders of the account off; it needs no account key and no sign-in."},"ReminderView":{"properties":{"enabled":{"type":"boolean","title":"Enabled"},"period_days":{"type":"integer","title":"Period Days"},"default_period_days":{"type":"integer","title":"Default Period Days"}},"type":"object","required":["enabled","period_days","default_period_days"],"title":"ReminderView","description":"The response body for `GET` and `PUT /v1/account/reminders` (MVP-R-115): whether the reminders of the account are on,\nthe period in days after which an agent without a check is reminded, and the default period."},"ReportRange":{"properties":{"from":{"type":"string","format":"date-time","title":"From"},"to":{"type":"string","format":"date-time","title":"To"}},"additionalProperties":false,"type":"object","required":["from","to"],"title":"ReportRange"},"RuleCatalogView":{"properties":{"catalog_version":{"type":"string","title":"Catalog Version"},"license":{"type":"string","title":"License"},"rules":{"items":{"$ref":"#/components/schemas/CatalogRuleView"},"type":"array","title":"Rules"}},"type":"object","required":["catalog_version","license","rules"],"title":"RuleCatalogView","description":"The response body for `GET /v1/catalogs/{catalog_id}` with\n`catalog_id=\"rules\"` (R-23, Decision 0040): the versioned rule catalog\n`a2a.engine.CATALOG_VERSION` currently scores submissions with\n(`a2a.engine.catalog.load_rule_catalog`), its own `catalog_version`\n(`RuleCatalog.version`) and the fixed `license` the route answers for\nevery catalog, `\"CC-BY-4.0\"` (`catalog/LICENSE`). Two requests for the\nsame `catalog_id` answer byte-identical JSON: `load_rule_catalog` is\n`functools.cache`d and this model carries no per-request state."},"RuleClass":{"type":"string","enum":["purpose","authority","state","rules","handoffs","tests","exceptions","loop_hygiene","bloat"],"title":"RuleClass"},"RuleClassWithNetwork":{"type":"string","enum":["purpose","authority","state","rules","handoffs","tests","exceptions","loop_hygiene","bloat","network"],"title":"RuleClassWithNetwork","description":"The rule classes of scoring 1.3.0 (MVP-R-34): the nine of `RuleClass` and Netzwerk.\n`RuleClass` and the contract versions 1.0.0 and 1.1.0 built on it stay as they are;\nthe engine's own models carry this one so a catalog with Netzwerk rules can run."},"RuleCount":{"properties":{"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"type":"string","title":"Rule Class"},"findings":{"type":"integer","title":"Findings"},"verdicts":{"$ref":"#/components/schemas/VerdictCounts"},"without_verdict":{"type":"integer","title":"Without Verdict"}},"additionalProperties":false,"type":"object","required":["rule_id","rule_class","findings","verdicts","without_verdict"],"title":"RuleCount"},"RuleOutcome":{"properties":{"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"outcome":{"type":"string","enum":["violated","satisfied","not_applicable"],"title":"Outcome"},"reason":{"anyOf":[{"type":"string","enum":["component_absent","no_field_for_harness","no_acting_capability","language_not_supported"]},{"type":"null"}],"title":"Reason"},"basis":{"anyOf":[{"type":"string","enum":["statement","setting"]},{"type":"null"}],"title":"Basis"},"notice":{"type":"boolean","title":"Notice","default":false}},"type":"object","required":["rule_id","rule_class","outcome"],"title":"RuleOutcome","description":"What one rule of the catalogue says about a package (MVP-R-59): `violated` (it fired),\n`satisfied`, or `not_applicable` with the reason `component_absent` (the package has no\ncomponent the rule needs) or `no_field_for_harness` (the harness has no field the rule reads,\nMVP-A-06). A satisfied rule that a sentence as well as a settings field can meet carries the\nbasis `statement` or `setting`. `notice` marks a rule that enters no score."},"RuleOutcomeV13":{"properties":{"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"outcome":{"type":"string","enum":["violated","satisfied","not_applicable"],"title":"Outcome"},"reason":{"anyOf":[{"type":"string","enum":["component_absent","no_field_for_harness"]},{"type":"null"}],"title":"Reason"},"basis":{"anyOf":[{"type":"string","enum":["statement","setting"]},{"type":"null"}],"title":"Basis"},"notice":{"type":"boolean","title":"Notice","default":false}},"additionalProperties":false,"type":"object","required":["rule_id","rule_class","outcome"],"title":"RuleOutcomeV13","description":"One outcome of a rule in contract version 1.3.0 (MVP-R-59)."},"RuleOutcomeV15":{"properties":{"rule_id":{"type":"string","title":"Rule Id"},"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"outcome":{"type":"string","enum":["violated","satisfied","not_applicable"],"title":"Outcome"},"reason":{"anyOf":[{"type":"string","enum":["component_absent","no_field_for_harness","no_acting_capability","language_not_supported"]},{"type":"null"}],"title":"Reason"},"basis":{"anyOf":[{"type":"string","enum":["statement","setting"]},{"type":"null"}],"title":"Basis"},"notice":{"type":"boolean","title":"Notice","default":false}},"additionalProperties":false,"type":"object","required":["rule_id","rule_class","outcome"],"title":"RuleOutcomeV15","description":"One outcome of a rule in contract version 1.5.0 (MVP-R-59, MVP-R-66, MVP-R-67): the reasons\n`no_acting_capability` and `language_not_supported` are part of the published schema."},"ScoreCap":{"properties":{"applied":{"type":"boolean","title":"Applied"},"rule_class":{"anyOf":[{"$ref":"#/components/schemas/RuleClassWithNetwork"},{"type":"null"}]},"limit":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Limit"},"mean_score":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mean Score"}},"additionalProperties":false,"type":"object","required":["applied","rule_class","limit","mean_score"],"title":"ScoreCap","description":"How the total of a list scored with scoring 1.4.0 came about (MVP-R-58):\n`total = min(mean_score, limit)` where `limit` is the lowest sub-score of a control class plus\n20. `applied` says whether the cap lowered the total, `rule_class` names the class that set it\n(only when it applied), `limit` is `None` without a scored control class."},"Severity":{"type":"string","enum":["info","medium","high"],"title":"Severity"},"SeverityV1":{"properties":{"level":{"$ref":"#/components/schemas/Severity"},"reason":{"type":"string","title":"Reason"}},"additionalProperties":false,"type":"object","required":["level","reason"],"title":"SeverityV1"},"SharingPolicyChange":{"properties":{"configuration":{"anyOf":[{"$ref":"#/components/schemas/PolicyValue"},{"type":"null"}]},"loop":{"anyOf":[{"$ref":"#/components/schemas/PolicyValue"},{"type":"null"}]},"memory_and_connections":{"anyOf":[{"$ref":"#/components/schemas/PolicyValue"},{"type":"null"}]},"failure_report":{"anyOf":[{"$ref":"#/components/schemas/PolicyValue"},{"type":"null"}]},"rule_contribution":{"anyOf":[{"$ref":"#/components/schemas/PolicyValue"},{"type":"null"}]},"questionnaire":{"anyOf":[{"$ref":"#/components/schemas/PolicyValue"},{"type":"null"}]}},"additionalProperties":false,"type":"object","title":"SharingPolicyChange","description":"The request body for `PUT /v1/agents/{agent_id}/sharing-policy`: a\nsubset of the five data classes (R-03) -- whichever the operator wants\nto change, `None` (the default) for the rest, left untouched. A field\nthe operator omits is missing from the JSON body, the same as `None`\nhere; `SharingPolicyService.set_by_operator` refuses an empty change on\nits own (`PolicyError`, mapped to 400 by `_policy_error_response`).\n\n`extra=\"forbid\"` (review of #23): without it, Pydantic silently drops an\nunknown field -- a typo'd data-class name (`memory_and_connection`) would\nlook like a successful, harmless request while the operator's intended\nchange to the real field never happened, leaving a data class allowed\nwhen they believed they had just blocked it."},"SharingPolicyView":{"properties":{"configuration":{"$ref":"#/components/schemas/PolicyValue"},"loop":{"$ref":"#/components/schemas/PolicyValue"},"memory_and_connections":{"$ref":"#/components/schemas/PolicyValue"},"failure_report":{"$ref":"#/components/schemas/PolicyValue"},"rule_contribution":{"$ref":"#/components/schemas/PolicyValue"},"questionnaire":{"$ref":"#/components/schemas/PolicyValue"}},"type":"object","required":["configuration","loop","memory_and_connections","failure_report","rule_contribution","questionnaire"],"title":"SharingPolicyView","description":"One agent's sharing policy (R-03): the data classes (the five of R-03\nand the questionnaire of MVP-R-107) as named\nfields rather than a bare mapping, so R-29's OpenAPI document names each\none -- the same five keys and order `SharingPolicy.as_dict()`\n(`a2a/policies.py`) already fixes. Both the operator response (the\nupdated rule) and the agent response (its own rule, R-05) use this same\nshape."},"SkippedCheckRequest":{"properties":{"fingerprint":{"type":"string","pattern":"^[0-9a-f]{64}$","title":"Fingerprint"},"trigger":{"type":"string","pattern":"^[a-z][a-z0-9_-]{0,39}$","title":"Trigger"},"reason":{"type":"string","maxLength":200,"minLength":1,"pattern":"^[^\\x00-\\x1f\\x7f]+$","title":"Reason"}},"additionalProperties":false,"type":"object","required":["fingerprint","trigger","reason"],"title":"SkippedCheckRequest","description":"The request body for `POST /v1/agents/{agent_id}/skipped-checks` (MVP-R-93, point 98): the content hash of the\nconfiguration that was not checked, who skipped it (`trigger`: `workflow`, `hook`; lower case, at most 40 characters)\nand a short `reason` (at most 200 characters). No content, no finding."},"SkippedCheckView":{"properties":{"fingerprint":{"type":"string","title":"Fingerprint"},"trigger":{"type":"string","title":"Trigger"},"reason":{"type":"string","title":"Reason"},"recorded_at":{"type":"string","format":"date-time","title":"Recorded At"}},"type":"object","required":["fingerprint","trigger","reason","recorded_at"],"title":"SkippedCheckView","description":"One skipped check as the operator reads it (MVP-R-93, point 98): what the request said and when it was recorded."},"SkippedChecksView":{"properties":{"skipped_checks":{"items":{"$ref":"#/components/schemas/SkippedCheckView"},"type":"array","title":"Skipped Checks"}},"type":"object","required":["skipped_checks"],"title":"SkippedChecksView","description":"The response body for `GET /v1/agents/{agent_id}/skipped-checks` (MVP-R-93, point 98): the skipped checks of the\nagent, newest first, at most 100, kept 90 days."},"StateName":{"type":"string","enum":["gueltig","abgelaufen","fehlt","blockiert"],"title":"StateName"},"SubmissionAccepted":{"properties":{"stored":{"type":"boolean","title":"Stored","default":true},"submission_id":{"type":"string","title":"Submission Id"},"data_class":{"$ref":"#/components/schemas/DataClass"},"redaction_count":{"type":"integer","title":"Redaction Count"},"redactions":{"items":{"$ref":"#/components/schemas/RedactionInfo"},"type":"array","title":"Redactions"},"check_id":{"type":"string","title":"Check Id"}},"type":"object","required":["submission_id","data_class","redaction_count","redactions","check_id"],"title":"SubmissionAccepted","description":"The response body for a stored submission (R-12). `redaction_count`\nand `redactions` are R-10's response contract: \"die Antwort nennt Datei,\nZeile und Anzahl der Ersetzungen\" (review of #14 -- the first version of\nthis endpoint dropped them)."},"SubmissionRejected":{"properties":{"stored":{"type":"boolean","title":"Stored","default":false},"reason":{"anyOf":[{"$ref":"#/components/schemas/RejectionReason"},{"type":"null"}]},"message":{"type":"string","title":"Message"},"detail":{"additionalProperties":true,"type":"object","title":"Detail"}},"type":"object","required":["message"],"title":"SubmissionRejected","description":"The response body for a refused submission or a not-found lookup --\nreturned as-is, the literal JSON body of the 400/401/404/413/429\nresponse (see the module docstring). `reason` is `None` for a 404 with\nno `RejectionReason` to name (`get_findings`'s unknown `submission_id`);\nevery other caller still always sets it."},"SubmissionView":{"properties":{"submission_id":{"type":"string","title":"Submission Id"},"received_at":{"type":"string","format":"date-time","title":"Received At"},"filter_version":{"type":"string","title":"Filter Version"},"data_class":{"$ref":"#/components/schemas/DataClass"}},"type":"object","required":["submission_id","received_at","filter_version","data_class"],"title":"SubmissionView","description":"The response body for `GET /v1/operator/submissions/{submission_id}`\n(R-12): \"Jede angenommene Einreichung erhält eine eindeutige ID, einen\nZeitstempel und die Version der Filterregeln, mit der sie geprüft wurde,\nund ist unter dieser ID für den Betreiber abrufbar.\" Exactly those\nfields plus the data class, named by the glossary's `submission_field`\ngroup (`submission_id`, `received_at`, `filter_version`, `data_class`);\nnever the submitted files themselves, which no requirement asks to be\nhanded back and which `SubmissionLister.get` (`a2a/storage/repository.py`)\ndoes not read."},"SubscoreCap":{"properties":{"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"uncapped_score":{"type":"integer","title":"Uncapped Score"},"cap":{"type":"integer","title":"Cap"}},"additionalProperties":false,"type":"object","required":["rule_class","uncapped_score","cap"],"title":"SubscoreCap","description":"A class whose sub-score the cap of scoring 1.6.0 lowered (MVP-R-132): the class, its\nsub-score before the cap and the cap (70)."},"SubscoreCapV113":{"properties":{"rule_class":{"$ref":"#/components/schemas/RuleClassWithNetwork"},"uncapped_score":{"type":"integer","title":"Uncapped Score"},"cap":{"type":"integer","title":"Cap"}},"additionalProperties":false,"type":"object","required":["rule_class","uncapped_score","cap"],"title":"SubscoreCapV113","description":"A class whose sub-score the cap of scoring 1.6.0 lowered (MVP-R-132): `uncapped_score`, the\nsub-score before the cap, and `cap`, the value 70 it was lowered to."},"ToolChangeView":{"properties":{"server":{"type":"string","title":"Server"},"tool":{"type":"string","title":"Tool"},"status":{"type":"string","const":"changed","title":"Status","default":"changed"}},"type":"object","required":["server","tool"],"title":"ToolChangeView","description":"MVP-R-98: a tool of a re-check of the data class `memory_and_connections` whose description\nor input schema differs from the one in the last earlier check of the agent that stored hashes\nof its tools (`status` is `changed`, the `geaendert` of the concept). It is part of the comparison\nof MVP-R-19 and, like the findings on tool descriptions, delivered only while the account has the\npaid tier."},"ToolProvenance":{"properties":{"source":{"type":"string","const":"tool","title":"Source"},"tool":{"type":"string","title":"Tool"},"tool_version":{"type":"string","title":"Tool Version"},"tool_rule_id":{"type":"string","title":"Tool Rule Id"}},"additionalProperties":false,"type":"object","required":["source","tool","tool_version","tool_rule_id"],"title":"ToolProvenance","description":"A pinned tool and the tool's own rule id."},"ValidationError":{"properties":{"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"type":"array","title":"Location"},"msg":{"type":"string","title":"Message"},"type":{"type":"string","title":"Error Type"},"input":{"title":"Input"},"ctx":{"type":"object","title":"Context"}},"type":"object","required":["loc","msg","type"],"title":"ValidationError"},"VerdictCounts":{"properties":{"zutreffend":{"type":"integer","title":"Zutreffend"},"fehlalarm":{"type":"integer","title":"Fehlalarm"},"nicht_anwendbar":{"type":"integer","title":"Nicht Anwendbar"},"unklar":{"type":"integer","title":"Unklar"}},"additionalProperties":false,"type":"object","required":["zutreffend","fehlalarm","nicht_anwendbar","unklar"],"title":"VerdictCounts"},"WeeklySkippedCount":{"properties":{"week":{"type":"string","title":"Week"},"count":{"type":"integer","title":"Count"}},"type":"object","required":["week","count"],"title":"WeeklySkippedCount","description":"One row of `MetricsSnapshot.weekly_skipped_checks` (MVP-R-93, point 98): how many skipped checks were recorded in the\nISO-8601 calendar week `week` (UTC). A week and a number: no agent, no account, no hash, no reason."},"WeeklyStepCount":{"properties":{"week":{"type":"string","title":"Week"},"step":{"$ref":"#/components/schemas/FunnelStep"},"count":{"type":"integer","title":"Count"}},"type":"object","required":["week","step","count"],"title":"WeeklyStepCount","description":"One row of `MetricsSnapshot.weekly_steps` (MVP-R-31 to MVP-R-33, point 113): how many\naccounts took `step` for the first time in the ISO-8601 calendar week `week` (UTC). A week,\na step and a number: no account, no address, no content."},"WeeklySubmissionCount":{"properties":{"week":{"type":"string","title":"Week"},"data_class":{"$ref":"#/components/schemas/DataClass"},"count":{"type":"integer","title":"Count"}},"type":"object","required":["week","data_class","count"],"title":"WeeklySubmissionCount","description":"One row of `MetricsSnapshot.weekly_submissions` (R-30): how many\naccepted submissions of one `data_class` landed in one ISO-8601\ncalendar week, e.g. `week=\"2026-W39\"` -- see\n`docs/decisions/0027-metrics-endpoint.md` for why a calendar week and why\nthe whole submission history, not just the 30-day active window\n`active_agents`/`active_operators` use. Aggregate-only, like every field\nof `MetricsSnapshot`: no `submission_id` or `agent_id` is named."}},"securitySchemes":{"agent_token":{"type":"http","description":"The agent token issued at registration (R-02, R-31).","scheme":"bearer"},"account_key":{"type":"http","description":"The operator's account key (R-01, K14) -- not an agent token. A separate `HTTPBearer` instance only so the OpenAPI document names the right secret in the right place; both are checked the same way, explicitly, for the same reason `_bearer_scheme` above is.","scheme":"bearer"},"internal_metrics_secret":{"type":"http","description":"A static shared secret for the internal metrics endpoint (R-30), read from the INTERNAL_METRICS_SECRET_ENV environment variable by default -- not an agent token and not an operator account key. See docs/decisions/0027-metrics-endpoint.md.","scheme":"bearer"},"check_reader":{"type":"http","description":"An agent token (the checks of that agent) or the operator's account key (all checks of the account).","scheme":"bearer"}}}}