{
  "swagger": "2.0",
  "info": {
    "title": "UDB Control-Plane API",
    "version": "0.5.22",
    "description": "HTTP/JSON (gRPC-gateway) surface for UDB control-plane services. The core DataBroker data-plane RPCs are gRPC-native and are not represented here."
  },
  "tags": [
    {
      "name": "AnalyticsService"
    },
    {
      "name": "ApiKeyService"
    },
    {
      "name": "AssetService"
    },
    {
      "name": "AuthnService"
    },
    {
      "name": "AuthzService"
    },
    {
      "name": "BackupService"
    },
    {
      "name": "CacheService"
    },
    {
      "name": "ConfigService"
    },
    {
      "name": "ControlPlaneService"
    },
    {
      "name": "EmbeddingService"
    },
    {
      "name": "IdentityProviderService"
    },
    {
      "name": "LiveQueryService"
    },
    {
      "name": "LockService"
    },
    {
      "name": "MeteringService"
    },
    {
      "name": "NotificationService"
    },
    {
      "name": "SchedulerService"
    },
    {
      "name": "SearchService"
    },
    {
      "name": "StorageService"
    },
    {
      "name": "TenantService"
    },
    {
      "name": "VaultService"
    },
    {
      "name": "WebhookService"
    },
    {
      "name": "RoomService"
    },
    {
      "name": "PeerService"
    },
    {
      "name": "TrackService"
    },
    {
      "name": "TurnService"
    },
    {
      "name": "SignalingService"
    },
    {
      "name": "WorkflowService"
    },
    {
      "name": "DataBroker"
    }
  ],
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "paths": {
    "/v1/analytics/executor-performance": {
      "get": {
        "summary": "Query daily executor performance roll-ups.",
        "operationId": "getExecutorPerformance",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetExecutorPerformanceResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "executorIdentity",
            "description": "Empty = all executors",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "workloadKind",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "dateFrom",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "dateTo",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AnalyticsService"
        ],
        "x-udb-sdk-alias": "get_executor_performance",
        "x-udb-scope": [
          "udb:analytics:get-executor-performance"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "analytics",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/analytics/pipeline-metrics": {
      "post": {
        "summary": "Record a single pipeline stage request observation (called per-request).",
        "operationId": "recordPipelineMetric",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RecordPipelineMetricResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RecordPipelineMetricRequest"
            }
          }
        ],
        "tags": [
          "AnalyticsService"
        ],
        "x-udb-sdk-alias": "record_pipeline_metric",
        "x-udb-scope": [
          "udb:analytics:record-pipeline-metric"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "analytics",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/analytics/pipeline-summaries": {
      "get": {
        "summary": "Query aggregated pipeline stage performance snapshots.",
        "operationId": "getPipelineSummary",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetPipelineSummaryResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "stageName",
            "description": "Empty = all stages",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "hourFrom",
            "description": "ISO 8601 hour string",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "hourTo",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AnalyticsService"
        ],
        "x-udb-sdk-alias": "get_pipeline_summary",
        "x-udb-scope": [
          "udb:analytics:get-pipeline-summary"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "analytics",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/analytics/reconciliation-stats": {
      "get": {
        "summary": "Query daily reconciliation and conflict analytics.",
        "operationId": "getReconciliationAnalytics",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetReconciliationAnalyticsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "dateFrom",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "dateTo",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AnalyticsService"
        ],
        "x-udb-sdk-alias": "get_reconciliation_analytics",
        "x-udb-scope": [
          "udb:analytics:get-reconciliation-analytics"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "analytics",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/analytics/sla-compliance": {
      "get": {
        "summary": "Get SLA compliance report for a stage and time period.",
        "operationId": "getSlaCompliance",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetSlaComplianceResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "stageName",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "dateFrom",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "dateTo",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "p99ThresholdMs",
            "in": "query",
            "required": false,
            "type": "number",
            "format": "double"
          },
          {
            "name": "errorRateThreshold",
            "in": "query",
            "required": false,
            "type": "number",
            "format": "double"
          }
        ],
        "tags": [
          "AnalyticsService"
        ],
        "x-udb-sdk-alias": "get_sla_compliance",
        "x-udb-scope": [
          "udb:analytics:get-sla-compliance"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "analytics",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/analytics/snapshots:trigger": {
      "post": {
        "summary": "Manually trigger hourly snapshot aggregation (normally a cron job).",
        "operationId": "triggerSnapshot",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1TriggerSnapshotResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1TriggerSnapshotRequest"
            }
          }
        ],
        "tags": [
          "AnalyticsService"
        ],
        "x-udb-sdk-alias": "trigger_snapshot",
        "x-udb-scope": [
          "udb:analytics:trigger-snapshot"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "analytics",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/analytics/throughput": {
      "get": {
        "summary": "Get throughput statistics over a time window.",
        "operationId": "getThroughput",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetThroughputResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "hourFrom",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "hourTo",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AnalyticsService"
        ],
        "x-udb-sdk-alias": "get_throughput",
        "x-udb-scope": [
          "udb:analytics:get-throughput"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "analytics",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/api-keys": {
      "get": {
        "operationId": "listApiKeys",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListApiKeysResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "ownerId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "ownerType",
            "description": " - API_KEY_OWNER_TYPE_INTEGRATION: External system integration.\n - API_KEY_OWNER_TYPE_CICD: CI/CD pipeline\n - API_KEY_OWNER_TYPE_ANALYTICS: Read-only analytics / BI tool\n - API_KEY_OWNER_TYPE_TENANT: Tenant-scoped integration key\n - API_KEY_OWNER_TYPE_PROJECT: Project/application-scoped key",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "API_KEY_OWNER_TYPE_UNSPECIFIED",
              "API_KEY_OWNER_TYPE_INTEGRATION",
              "API_KEY_OWNER_TYPE_CICD",
              "API_KEY_OWNER_TYPE_ANALYTICS",
              "API_KEY_OWNER_TYPE_TENANT",
              "API_KEY_OWNER_TYPE_PROJECT",
              "API_KEY_OWNER_TYPE_SERVICE_ACCOUNT",
              "API_KEY_OWNER_TYPE_WORKLOAD"
            ],
            "default": "API_KEY_OWNER_TYPE_UNSPECIFIED"
          },
          {
            "name": "status",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "API_KEY_STATUS_UNSPECIFIED",
              "API_KEY_STATUS_ACTIVE",
              "API_KEY_STATUS_REVOKED",
              "API_KEY_STATUS_EXPIRED"
            ],
            "default": "API_KEY_STATUS_UNSPECIFIED"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "ApiKeyService"
        ],
        "x-udb-sdk-alias": "list_api_keys",
        "x-udb-scope": [
          "udb:apikey:list-api-keys"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "api-keys",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "── Key lifecycle (admin-only) ────────────────────────────────────────────\nReturns the plain key ONCE in CreateApiKeyResponse — never again.",
        "operationId": "createApiKey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateApiKeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateApiKeyRequest"
            }
          }
        ],
        "tags": [
          "ApiKeyService"
        ],
        "x-udb-sdk-alias": "create_api_key",
        "x-udb-scope": [
          "udb:apikey:create-api-key"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "api-keys",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/api-keys/{keyId}": {
      "get": {
        "operationId": "getApiKey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetApiKeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "keyId",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ],
        "tags": [
          "ApiKeyService"
        ],
        "x-udb-sdk-alias": "get_api_key",
        "x-udb-scope": [
          "udb:apikey:get-api-key"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "api-keys",
        "x-udb-operation-kind": "read_only"
      },
      "delete": {
        "operationId": "revokeApiKey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RevokeApiKeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "keyId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "revokeReason",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "ApiKeyService"
        ],
        "x-udb-sdk-alias": "revoke_api_key",
        "x-udb-scope": [
          "udb:apikey:revoke-api-key"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "api-keys",
        "x-udb-operation-kind": "mutation"
      },
      "patch": {
        "operationId": "updateApiKey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateApiKeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "keyId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ApiKeyServiceUpdateApiKeyBody"
            }
          }
        ],
        "tags": [
          "ApiKeyService"
        ],
        "x-udb-sdk-alias": "update_api_key",
        "x-udb-scope": [
          "udb:apikey:update-api-key"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "api-keys",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/api-keys/{keyId}/stats": {
      "get": {
        "summary": "── Usage stats ───────────────────────────────────────────────────────────",
        "operationId": "getApiKeyUsageStats",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetApiKeyUsageStatsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "keyId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "from",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "to",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          }
        ],
        "tags": [
          "ApiKeyService"
        ],
        "x-udb-sdk-alias": "get_api_key_usage_stats",
        "x-udb-scope": [
          "udb:apikey:get-api-key-usage-stats"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "api-keys",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/api-keys/{keyId}:rotate": {
      "post": {
        "summary": "Rotate a key's secret in place (same key_id + lineage). Returns the new\nplain key ONCE; the old secret is invalidated immediately.",
        "operationId": "rotateApiKey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RotateApiKeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "keyId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ApiKeyServiceRotateApiKeyBody"
            }
          }
        ],
        "tags": [
          "ApiKeyService"
        ],
        "x-udb-sdk-alias": "rotate_api_key",
        "x-udb-scope": [
          "udb:apikey:rotate-api-key"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "api-keys",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/api-keys:emergencyRevoke": {
      "post": {
        "summary": "Emergency bulk revoke by selector (prefix/owner/tenant/project/scope/before).",
        "operationId": "emergencyRevokeApiKeys",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1EmergencyRevokeApiKeysResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "Emergency revoke matching keys by one or more selectors. At least one selector\nmust be set. Resolves matching records and revokes each (no prefix-only blind\nmutation): the caller's tenant/owner/admin authority is enforced per record.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1EmergencyRevokeApiKeysRequest"
            }
          }
        ],
        "tags": [
          "ApiKeyService"
        ],
        "x-udb-sdk-alias": "emergency_revoke_api_keys",
        "x-udb-scope": [
          "udb:apikey:emergency-revoke-api-keys"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "api-keys",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/api-keys:validate": {
      "post": {
        "summary": "── Validation (called by API gateway — internal, not public HTTP) ────────",
        "operationId": "validateApiKey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ValidateApiKeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ValidateApiKeyRequest"
            }
          }
        ],
        "tags": [
          "ApiKeyService"
        ],
        "x-udb-sdk-alias": "validate_api_key",
        "x-udb-scope": [
          "udb:apikey:validate-api-key"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "api-keys",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/assets": {
      "get": {
        "summary": "List assets",
        "operationId": "listAssets",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListAssetsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "mediaType",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "status",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListAssetsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AssetService"
        ],
        "x-udb-sdk-alias": "list_assets",
        "x-udb-scope": [
          "udb:asset:list-assets"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "assets",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "Register a managed asset wrapping a storage file",
        "operationId": "registerAsset",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RegisterAssetResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RegisterAssetRequest"
            }
          }
        ],
        "tags": [
          "AssetService"
        ],
        "x-udb-sdk-alias": "register_asset",
        "x-udb-scope": [
          "udb:asset:register-asset"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "assets",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/assets/pipeline-definitions": {
      "post": {
        "summary": "Create a reusable pipeline definition",
        "operationId": "createPipelineDefinition",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreatePipelineDefinitionResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreatePipelineDefinitionRequest"
            }
          }
        ],
        "tags": [
          "AssetService"
        ],
        "x-udb-sdk-alias": "create_pipeline_definition",
        "x-udb-scope": [
          "udb:asset:create-pipeline-definition"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "assets",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/assets/pipeline-definitions/{definitionId}": {
      "get": {
        "summary": "Get a pipeline definition",
        "operationId": "getPipelineDefinition",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetPipelineDefinitionResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "definitionId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AssetService"
        ],
        "x-udb-sdk-alias": "get_pipeline_definition",
        "x-udb-scope": [
          "udb:asset:get-pipeline-definition"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "assets",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/assets/pipelines": {
      "post": {
        "summary": "Start a pipeline instance for an asset",
        "operationId": "startPipeline",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1StartPipelineResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1StartPipelineRequest"
            }
          }
        ],
        "tags": [
          "AssetService"
        ],
        "x-udb-sdk-alias": "start_pipeline",
        "x-udb-scope": [
          "udb:asset:start-pipeline"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "correlation_id",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": true
        },
        "x-udb-resource": "assets",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/assets/pipelines/{instanceId}": {
      "get": {
        "summary": "Get a pipeline instance with its steps",
        "operationId": "getPipeline",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetPipelineResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "instanceId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AssetService"
        ],
        "x-udb-sdk-alias": "get_pipeline",
        "x-udb-scope": [
          "udb:asset:get-pipeline"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "assets",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/assets/steps/{stepId}:complete": {
      "post": {
        "summary": "Complete (or skip/fail) a pipeline step",
        "operationId": "completeStep",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CompleteStepResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "stepId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AssetServiceCompleteStepBody"
            }
          }
        ],
        "tags": [
          "AssetService"
        ],
        "x-udb-sdk-alias": "complete_step",
        "x-udb-scope": [
          "udb:asset:complete-step"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "assets",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/assets/{assetId}": {
      "get": {
        "summary": "Get an asset",
        "operationId": "getAsset",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetAssetResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "assetId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AssetService"
        ],
        "x-udb-sdk-alias": "get_asset",
        "x-udb-scope": [
          "udb:asset:get-asset"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "assets",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/.well-known/jwks.json": {
      "get": {
        "summary": "JSON Web Key Set for verifying UDB-issued JWTs. Public.",
        "operationId": "getJwks",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetJwksResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "get_jwks",
        "x-udb-scope": [],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/admin/tenants/{tenantId}/sessions:revokeAll": {
      "post": {
        "operationId": "adminRevokeAllTenantSessions",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AdminRevokeAllTenantSessionsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceAdminRevokeAllTenantSessionsBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "admin_revoke_all_tenant_sessions",
        "x-udb-scope": [
          "udb:authn:admin-revoke-all-tenant-sessions"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/admin/users/{userId}/mfa:reset": {
      "post": {
        "operationId": "adminResetMfa",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AdminResetMfaResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceAdminResetMfaBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "admin_reset_mfa",
        "x-udb-scope": [
          "udb:authn:admin-reset-mfa"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/admin/users/{userId}/sessions:revoke": {
      "post": {
        "operationId": "adminRevokeSession",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AdminRevokeSessionResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceAdminRevokeSessionBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "admin_revoke_session",
        "x-udb-scope": [
          "udb:authn:admin-revoke-session"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/admin/users/{userId}/sessions:revokeAll": {
      "post": {
        "operationId": "adminRevokeAllUserSessions",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AdminRevokeAllUserSessionsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceAdminRevokeAllUserSessionsBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "admin_revoke_all_user_sessions",
        "x-udb-scope": [
          "udb:authn:admin-revoke-all-user-sessions"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/admin:emergencyRevoke": {
      "post": {
        "operationId": "emergencyRevoke",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1EmergencyRevokeResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "Emergency global revoke by signing key / token family / tenant / principal.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1EmergencyRevokeRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "emergency_revoke",
        "x-udb-scope": [
          "udb:authn:emergency-revoke"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/certificate-bindings": {
      "get": {
        "summary": "Page through the tenant's mTLS certificate bindings (tenant-scoped;\ncross-tenant reads are rejected).",
        "operationId": "listCertificateBindings",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListCertificateBindingsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListCertificateBindingsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "list_certificate_bindings",
        "x-udb-scope": [
          "udb:authn:read-grants"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "Bind an mTLS certificate selector to a service account. The principal is\nalways derived from the account's CURRENT grant at request time (optionally\nattenuated by scope_subset); an unknown or misbound certificate fails closed.",
        "operationId": "createCertificateBinding",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateCertificateBindingResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateCertificateBindingRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "create_certificate_binding",
        "x-udb-scope": [
          "udb:authn:manage-grants"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/certificate-bindings/{bindingId}:revoke": {
      "post": {
        "summary": "Revoke a certificate binding. Certificates matching the selector stop\nauthenticating immediately — fail closed, audited.",
        "operationId": "revokeCertificateBinding",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RevokeCertificateBindingResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "bindingId",
            "description": "Canonical binding id returned by CreateCertificateBinding (server-assigned UUID).",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceRevokeCertificateBindingBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "revoke_certificate_binding",
        "x-udb-scope": [
          "udb:authn:manage-grants"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/credentials:authenticate": {
      "post": {
        "summary": "── Authentication ───────────────────────────────────────────────────────",
        "operationId": "authenticate",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuthnResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1AuthnRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "authenticate",
        "x-udb-scope": [],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/csrf-tokens:validate": {
      "post": {
        "summary": "── CSRF (server-side sessions only) ────────────────────────────────────",
        "operationId": "validateCsrf",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ValidateCSRFResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ValidateCSRFRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "validate_csrf",
        "x-udb-scope": [
          "udb:authn:validate-csrf"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/devices/{deviceId}": {
      "delete": {
        "operationId": "revokeDevice",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RevokeDeviceResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "deviceId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "reason",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "revoke_device",
        "x-udb-scope": [
          "udb:authn:revoke-device"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/mfa/challenges:issue": {
      "post": {
        "summary": "── MFA challenge + factor lifecycle (Phase 3 / I2.6) ────────────────────",
        "operationId": "issueMfaChallenge",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1IssueMfaChallengeResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1IssueMfaChallengeRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "issue_mfa_challenge",
        "x-udb-scope": [
          "udb:authn:issue-mfa-challenge"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/mfa/challenges:verify": {
      "post": {
        "operationId": "verifyMfaChallenge",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1VerifyMfaChallengeResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1VerifyMfaChallengeRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "verify_mfa_challenge",
        "x-udb-scope": [
          "udb:authn:verify-mfa-challenge"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/otps:resend": {
      "post": {
        "operationId": "resendOtp",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ResendOTPResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ResendOTPRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "resend_otp",
        "x-udb-scope": [
          "udb:authn:resend-otp"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/otps:send": {
      "post": {
        "summary": "── OTP ──────────────────────────────────────────────────────────────────",
        "operationId": "sendOtp",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SendOTPResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SendOTPRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "send_otp",
        "x-udb-scope": [
          "udb:authn:send-otp"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/otps:verify": {
      "post": {
        "operationId": "verifyOtp",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1VerifyOTPResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1VerifyOTPRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "verify_otp",
        "x-udb-scope": [
          "udb:authn:verify-otp"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/password-sessions": {
      "post": {
        "operationId": "login",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1LoginResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1LoginRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "login",
        "x-udb-scope": [],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/passwords:change": {
      "post": {
        "operationId": "changePassword",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ChangePasswordResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ChangePasswordRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "change_password",
        "x-udb-scope": [
          "udb:authn:change-password"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/passwords:forgot": {
      "post": {
        "summary": "User-initiated password reset: issues a PASSWORD_RESET OTP (delivered to the\naccount's channel). Public — no bearer required.",
        "operationId": "forgotPassword",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ForgotPasswordResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ForgotPasswordRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "forgot_password",
        "x-udb-scope": [],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/passwords:reset": {
      "post": {
        "summary": "Complete a password reset with the OTP from ForgotPassword (no current\npassword required). Public — the OTP is the proof of control.",
        "operationId": "resetPassword",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ResetPasswordResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ResetPasswordRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "reset_password",
        "x-udb-scope": [],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/service-account-grants": {
      "get": {
        "summary": "Page through the tenant's typed service-account grants (tenant-scoped;\ncross-tenant reads are rejected).",
        "operationId": "listServiceAccountGrants",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListServiceAccountGrantsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListServiceAccountGrantsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "list_service_account_grants",
        "x-udb-scope": [
          "udb:authn:read-grants"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/service-accounts/{fromUserId}/grant:transfer": {
      "post": {
        "summary": "Atomically transfer an ACTIVE service-account grant (its stable\nservice_identity and approved scopes) from one service account to another,\nunder revision CAS. The grant row is re-pointed from `from_user_id` to\n`to_user_id` in a single transaction, so neither the deployment-wide\nservice_identity unique index nor the per-user unique index is ever\nviolated, and no window exists in which no account owns the identity. The\nsource account is left with no grant (its credentials no longer resolve to\nthe identity); the move is a deterministic inverse of itself. This is the\nsupported recovery path when the currently-bound account's credentials are\nunavailable, replacing a non-atomic rotate-then-create.",
        "operationId": "transferServiceAccountGrant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1TransferServiceAccountGrantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "fromUserId",
            "description": "The service account that currently holds the grant/identity.",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceTransferServiceAccountGrantBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "transfer_service_account_grant",
        "x-udb-scope": [
          "udb:authn:manage-grants"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/service-accounts/{userId}/grant": {
      "get": {
        "summary": "Read the current typed grant for a service account; NOT_FOUND when the\naccount has no grant (the account then cannot authenticate — fail closed).",
        "operationId": "getServiceAccountGrant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetServiceAccountGrantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "get_service_account_grant",
        "x-udb-scope": [
          "udb:authn:read-grants"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "── Typed service-account grants + mTLS certificate bindings (UDB-AUTH-003/007) ──\nCreate the single typed grant for a service account: immutable service\nidentity, tenant/project binding, and operator-approved scopes.\nAdmin/owner/wildcard scopes are rejected at write time (fail closed).",
        "operationId": "createServiceAccountGrant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateServiceAccountGrantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceCreateServiceAccountGrantBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "create_service_account_grant",
        "x-udb-scope": [
          "udb:authn:manage-grants"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/service-accounts/{userId}/grant:replace": {
      "post": {
        "summary": "Replace a grant's approved scopes/project atomically, bumping `revision` so\ndependent credentials and bindings detect staleness. A stale\nexpected_revision fails with FAILED_PRECONDITION (fail closed).",
        "operationId": "replaceServiceAccountGrant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ReplaceServiceAccountGrantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceReplaceServiceAccountGrantBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "replace_service_account_grant",
        "x-udb-scope": [
          "udb:authn:manage-grants"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/service-accounts/{userId}/grant:revoke": {
      "post": {
        "summary": "Revoke a service account's grant. The account (and every credential or\ncertificate binding that resolves through the grant) stops authenticating\nimmediately — fail closed, audited.",
        "operationId": "revokeServiceAccountGrant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RevokeServiceAccountGrantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceRevokeServiceAccountGrantBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "revoke_service_account_grant",
        "x-udb-scope": [
          "udb:authn:manage-grants"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/service-accounts/{userId}/grant:rotateIdentity": {
      "post": {
        "summary": "Rotate the immutable service identity through an explicit audited CAS.\nThe revision bump invalidates all API keys and certificate bindings\nreviewed against the prior identity; already-issued service JWTs fail the\ncurrent-grant identity check immediately.",
        "operationId": "rotateServiceAccountIdentity",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RotateServiceAccountIdentityResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceRotateServiceAccountIdentityBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "rotate_service_account_identity",
        "x-udb-scope": [
          "udb:authn:manage-grants"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/sessions": {
      "post": {
        "summary": "── Session management ───────────────────────────────────────────────────",
        "operationId": "createSession",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateSessionResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateSessionRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "create_session",
        "x-udb-scope": [
          "udb:authn:create-session"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/sessions/{sessionId}": {
      "get": {
        "operationId": "getSession",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetSessionResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "sessionId",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "get_session",
        "x-udb-scope": [
          "udb:authn:get-session"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      },
      "delete": {
        "operationId": "revokeSession",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RevokeSessionResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "sessionId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "revokeReason",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "allForPrincipal",
            "in": "query",
            "required": false,
            "type": "boolean"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "revoke_session",
        "x-udb-scope": [
          "udb:authn:revoke-session"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/sessions/{sessionId}:refresh": {
      "post": {
        "operationId": "refreshSession",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RefreshSessionResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "sessionId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceRefreshSessionBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "refresh_session",
        "x-udb-scope": [
          "udb:authn:refresh-session"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/sessions:logout": {
      "post": {
        "operationId": "logout",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1LogoutResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1LogoutRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "logout",
        "x-udb-scope": [
          "udb:authn:logout"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/tenants/{tenantId}/mfa-policy": {
      "get": {
        "summary": "Read the per-tenant MFA enforcement policy.",
        "operationId": "getMfaPolicy",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetMfaPolicyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "get_mfa_policy",
        "x-udb-scope": [
          "udb:authn:get-mfa-policy"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      },
      "put": {
        "summary": "Set the per-tenant MFA enforcement policy.",
        "operationId": "putMfaPolicy",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PutMfaPolicyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServicePutMfaPolicyBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "put_mfa_policy",
        "x-udb-scope": [
          "udb:authn:put-mfa-policy"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/tokens:introspect": {
      "post": {
        "summary": "OAuth2-style token introspection for a UDB-issued JWT.",
        "operationId": "introspectToken",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1IntrospectTokenResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1IntrospectTokenRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "introspect_token",
        "x-udb-scope": [
          "udb:authn:introspect-token"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/tokens:refresh": {
      "post": {
        "operationId": "refreshToken",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RefreshTokenResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RefreshTokenRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "refresh_token",
        "x-udb-scope": [],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/tokens:validate": {
      "post": {
        "summary": "── Token validation (called by gateway + per-service interceptors) ───────",
        "operationId": "validateToken",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ValidateTokenResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ValidateTokenRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "validate_token",
        "x-udb-scope": [
          "udb:authn:validate-token"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/users": {
      "get": {
        "operationId": "listUsers",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListUsersResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "accountKind",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "ACCOUNT_KIND_UNSPECIFIED",
              "ACCOUNT_KIND_PERSON",
              "ACCOUNT_KIND_SERVICE_ACCOUNT",
              "ACCOUNT_KIND_WORKLOAD",
              "ACCOUNT_KIND_EXTERNAL_IDENTITY",
              "ACCOUNT_KIND_SYSTEM",
              "ACCOUNT_KIND_ANONYMOUS"
            ],
            "default": "ACCOUNT_KIND_UNSPECIFIED"
          },
          {
            "name": "status",
            "description": " - USER_STATUS_PENDING_VERIFICATION: Email not yet verified\n - USER_STATUS_SUSPENDED: Temporarily suspended by admin\n - USER_STATUS_LOCKED: Locked after repeated failed logins\n - USER_STATUS_DEACTIVATED: Permanently deactivated",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "USER_STATUS_UNSPECIFIED",
              "USER_STATUS_PENDING_VERIFICATION",
              "USER_STATUS_ACTIVE",
              "USER_STATUS_SUSPENDED",
              "USER_STATUS_LOCKED",
              "USER_STATUS_DEACTIVATED"
            ],
            "default": "USER_STATUS_UNSPECIFIED"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "list_users",
        "x-udb-scope": [
          "udb:authn:list-users"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "── User management (admin-only) ─────────────────────────────────────────",
        "operationId": "createUser",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateUserResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateUserRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "create_user",
        "x-udb-scope": [
          "udb:authn:create-user"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}": {
      "get": {
        "operationId": "getUser",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetUserResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "description": "lookup by ID",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "username",
            "description": "or by username",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "email",
            "description": "or by email",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "get_user",
        "x-udb-scope": [
          "udb:authn:get-user"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      },
      "patch": {
        "operationId": "updateUser",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateUserResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceUpdateUserBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "update_user",
        "x-udb-scope": [
          "udb:authn:update-user"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}/devices": {
      "get": {
        "summary": "── Device + session revocation lifecycle (Phase 3 / I2.4) ───────────────",
        "operationId": "listDevices",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListDevicesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "list_devices",
        "x-udb-scope": [
          "udb:authn:list-devices"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/users/{userId}/mfa/factors": {
      "get": {
        "operationId": "listMfaFactors",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListMfaFactorsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "description": "Requested page size. Defaults to 50 and is capped at the native list maximum.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListMfaFactorsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "list_mfa_factors",
        "x-udb-scope": [
          "udb:authn:list-mfa-factors"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/users/{userId}/mfa/factors:disable": {
      "post": {
        "operationId": "disableMfaFactor",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DisableMfaFactorResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceDisableMfaFactorBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "disable_mfa_factor",
        "x-udb-scope": [
          "udb:authn:disable-mfa-factor"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}/mfa:confirm": {
      "post": {
        "summary": "Step 2: confirm with first TOTP code (or email OTP)",
        "operationId": "confirmMfaenrollment",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ConfirmMFAEnrollmentResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceConfirmMFAEnrollmentBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "confirm_mfaenrollment",
        "x-udb-scope": [
          "udb:authn:confirm-mfa-enrollment"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}/mfa:enroll": {
      "post": {
        "summary": "── MFA enrollment ───────────────────────────────────────────────────────\nStep 1: initiate enrollment — returns TOTP secret / QR URI",
        "operationId": "enrollMfa",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1EnrollMFAResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceEnrollMFABody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "enroll_mfa",
        "x-udb-scope": [
          "udb:authn:enroll-mfa"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}/passwords:reset": {
      "post": {
        "summary": "Admin-triggered password reset — sends email OTP to complete flow",
        "operationId": "adminResetPassword",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AdminResetPasswordResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceAdminResetPasswordBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "admin_reset_password",
        "x-udb-scope": [
          "udb:authn:admin-reset-password"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/users/{userId}/phones:verify": {
      "post": {
        "summary": "Set the user's phone number and send an SMS verification OTP. Complete with\nVerifyOTP (the response is verified the same way as email).",
        "operationId": "sendPhoneVerification",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SendPhoneVerificationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceSendPhoneVerificationBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "send_phone_verification",
        "x-udb-scope": [
          "udb:authn:send-phone-verification"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}/recovery-codes:generate": {
      "post": {
        "summary": "Generate a fresh set of single-use MFA recovery/backup codes (returned once;\nany prior codes for the user are invalidated).",
        "operationId": "generateRecoveryCodes",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GenerateRecoveryCodesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceGenerateRecoveryCodesBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "generate_recovery_codes",
        "x-udb-scope": [
          "udb:authn:generate-recovery-codes"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}/recovery-codes:revoke": {
      "post": {
        "operationId": "revokeRecoveryCodes",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RevokeRecoveryCodesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceRevokeRecoveryCodesBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "revoke_recovery_codes",
        "x-udb-scope": [
          "udb:authn:revoke-recovery-codes"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}/sessions": {
      "get": {
        "operationId": "listSessions",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListSessionsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "activeOnly",
            "in": "query",
            "required": false,
            "type": "boolean"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "list_sessions",
        "x-udb-scope": [
          "udb:authn:list-sessions"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/users/{userId}/webauthn/credentials": {
      "get": {
        "summary": "── WebAuthn enterprise credential lifecycle (Phase 3 / I2.7) ────────────",
        "operationId": "listWebAuthnCredentials",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListWebAuthnCredentialsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "description": "Requested page size. Defaults to 50 and is capped at the native list maximum.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListWebAuthnCredentialsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "list_web_authn_credentials",
        "x-udb-scope": [
          "udb:authn:list-web-authn-credentials"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/auth/users/{userId}/webauthn/credentials/{credentialId}": {
      "delete": {
        "operationId": "deleteWebAuthnCredential",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteWebAuthnCredentialResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "credentialId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "delete_web_authn_credential",
        "x-udb-scope": [
          "udb:authn:delete-web-authn-credential"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}/webauthn/credentials:rename": {
      "post": {
        "operationId": "renamePasskey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RenamePasskeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceRenamePasskeyBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "rename_passkey",
        "x-udb-scope": [
          "udb:authn:rename-passkey"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}/webauthn/registration:start": {
      "post": {
        "summary": "── WebAuthn / passkeys ─────────────────────────────────────────────────",
        "operationId": "startWebAuthnRegistration",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1StartWebAuthnRegistrationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceStartWebAuthnRegistrationBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "start_web_authn_registration",
        "x-udb-scope": [
          "udb:authn:start-web-authn-registration"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/users/{userId}:changeStatus": {
      "post": {
        "operationId": "changeUserStatus",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ChangeUserStatusResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthnServiceChangeUserStatusBody"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "change_user_status",
        "x-udb-scope": [
          "udb:authn:change-user-status"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/auth/webauthn/authentication:finish": {
      "post": {
        "operationId": "finishWebAuthnAuthentication",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FinishWebAuthnAuthenticationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1FinishWebAuthnAuthenticationRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "finish_web_authn_authentication",
        "x-udb-scope": [],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/webauthn/authentication:start": {
      "post": {
        "operationId": "startWebAuthnAuthentication",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1StartWebAuthnAuthenticationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1StartWebAuthnAuthenticationRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "start_web_authn_authentication",
        "x-udb-scope": [],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/auth/webauthn/registration:finish": {
      "post": {
        "operationId": "finishWebAuthnRegistration",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FinishWebAuthnRegistrationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1FinishWebAuthnRegistrationRequest"
            }
          }
        ],
        "tags": [
          "AuthnService"
        ],
        "x-udb-sdk-alias": "finish_web_authn_registration",
        "x-udb-scope": [
          "udb:authn:finish-web-authn-registration"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "auth",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/audits": {
      "get": {
        "operationId": "listAccessDecisionAudits",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListAccessDecisionAuditsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "domain",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "list_access_decision_audits",
        "x-udb-scope": [
          "udb:authz:list-access-decision-audits"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/authorize": {
      "post": {
        "operationId": "authorize",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuthzResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1AuthzRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "authorize",
        "x-udb-scope": [
          "udb:authz:authorize"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/checks": {
      "post": {
        "operationId": "checkAccess",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CheckAccessResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CheckAccessRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "check_access",
        "x-udb-scope": [
          "udb:authz:check-access"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/checks:batch": {
      "post": {
        "summary": "Batch check multiple permissions at once.",
        "operationId": "batchCheckPermissions",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1BatchCheckPermissionsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1BatchCheckPermissionsRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "batch_check_permissions",
        "x-udb-scope": [
          "udb:authz:batch-check-permissions"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/governance/bundles:invalidate": {
      "post": {
        "operationId": "invalidatePolicyBundles",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1InvalidatePolicyBundlesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1InvalidatePolicyBundlesRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "invalidate_policy_bundles",
        "x-udb-scope": [
          "udb:authz:admin"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/authz/governance/canaries/{canaryId}": {
      "get": {
        "summary": "Read a canary's current state + promote-eligibility.",
        "operationId": "getCanaryStatus",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetCanaryStatusResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "canaryId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "actor.subject",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "actor.tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "actor.projectId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "actor.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "actor.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "actor.breakGlass",
            "description": "Break-glass: when set, a short-TTL emergency bypass with a recorded reason.",
            "in": "query",
            "required": false,
            "type": "boolean"
          },
          {
            "name": "actor.breakGlassReason",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "actor.breakGlassExpiresAtUnix",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "int64"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "get_canary_status",
        "x-udb-scope": [
          "udb:authz:policy:read"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/governance/canaries:activate": {
      "post": {
        "summary": "Activate a policy version to a canary scope (subset of the fleet) before\nfleet-wide. A metric-based evaluator then auto-rolls back on breach.",
        "operationId": "activateCanary",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CanaryResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "Activate a policy version to a CANARY scope (a subset of the fleet) rather\nthan fleet-wide. The version is served only to in-scope nodes/tenants (or a\npercentage slice) while a metric-based evaluator watches the success window;\nit then either promotes fleet-wide, auto-rolls back on breach, or pauses on\nan inconclusive signal. Additive to the Phase-K activation surface.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ActivateCanaryRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "activate_canary",
        "x-udb-scope": [
          "udb:authz:admin"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/authz/governance/canaries:promote": {
      "post": {
        "summary": "Promote a baked, within-threshold canary to fleet-wide enforcement.",
        "operationId": "promoteCanary",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CanaryResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "Promote a baked (within-threshold) canary to fleet-wide. Fails unless the\ncanary is promote-eligible (ACTIVE and its success window has elapsed within\nthreshold). On success the canaried version becomes the active version of its\npolicy set fleet-wide and the canary moves to PROMOTED.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1PromoteCanaryRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "promote_canary",
        "x-udb-scope": [
          "udb:authz:admin"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/authz/governance/drafts": {
      "post": {
        "operationId": "createPolicyDraft",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PolicyDraftResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreatePolicyDraftRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "create_policy_draft",
        "x-udb-scope": [
          "udb:authz:policy:write"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/governance/drafts:approve": {
      "post": {
        "operationId": "approvePolicyDraft",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PolicyApprovalResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ApprovePolicyDraftRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "approve_policy_draft",
        "x-udb-scope": [
          "udb:authz:policy:approve"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/governance/drafts:diff": {
      "post": {
        "operationId": "diffPolicyDraft",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DiffPolicyDraftResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DiffPolicyDraftRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "diff_policy_draft",
        "x-udb-scope": [
          "udb:authz:policy:read"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/governance/drafts:reject": {
      "post": {
        "operationId": "rejectPolicyDraft",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PolicyApprovalResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RejectPolicyDraftRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "reject_policy_draft",
        "x-udb-scope": [
          "udb:authz:policy:approve"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/governance/drafts:submit": {
      "post": {
        "operationId": "submitPolicyDraft",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PolicyDraftResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SubmitPolicyDraftRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "submit_policy_draft",
        "x-udb-scope": [
          "udb:authz:policy:write"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/governance/drafts:update": {
      "post": {
        "operationId": "updatePolicyDraft",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PolicyDraftResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1UpdatePolicyDraftRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "update_policy_draft",
        "x-udb-scope": [
          "udb:authz:policy:write"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/governance/legacy:migrate": {
      "post": {
        "operationId": "migrateLegacyPolicies",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1MigrateLegacyPoliciesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1MigrateLegacyPoliciesRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "migrate_legacy_policies",
        "x-udb-scope": [
          "udb:authz:admin"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/authz/governance/policy-explanations": {
      "post": {
        "operationId": "explainPolicy",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ExplainPolicyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ExplainPolicyRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "explain_policy",
        "x-udb-scope": [
          "udb:authz:policy:read"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/governance/policy-simulations": {
      "post": {
        "operationId": "simulatePolicy",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SimulatePolicyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SimulatePolicyRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "simulate_policy",
        "x-udb-scope": [
          "udb:authz:policy:read"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/governance/revisions/current": {
      "get": {
        "operationId": "getAuthzRevision",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetAuthzRevisionResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "projectId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "get_authz_revision",
        "x-udb-scope": [
          "udb:authz:policy:read"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/governance/roles:seed": {
      "post": {
        "operationId": "seedBuiltinRoles",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SeedBuiltinRolesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SeedBuiltinRolesRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "seed_builtin_roles",
        "x-udb-scope": [
          "udb:authz:admin"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/governance/versions": {
      "get": {
        "operationId": "listPolicyVersions",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListPolicyVersionsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "actor.subject",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "actor.tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "actor.projectId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "actor.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "actor.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "actor.breakGlass",
            "description": "Break-glass: when set, a short-TTL emergency bypass with a recorded reason.",
            "in": "query",
            "required": false,
            "type": "boolean"
          },
          {
            "name": "actor.breakGlassReason",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "actor.breakGlassExpiresAtUnix",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "int64"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "projectId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "policySetId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "state",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "POLICY_VERSION_STATE_UNSPECIFIED",
              "POLICY_VERSION_STATE_DRAFT",
              "POLICY_VERSION_STATE_PENDING_REVIEW",
              "POLICY_VERSION_STATE_APPROVED",
              "POLICY_VERSION_STATE_ACTIVE",
              "POLICY_VERSION_STATE_SUPERSEDED",
              "POLICY_VERSION_STATE_REJECTED",
              "POLICY_VERSION_STATE_ROLLED_BACK"
            ],
            "default": "POLICY_VERSION_STATE_UNSPECIFIED"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "list_policy_versions",
        "x-udb-scope": [
          "udb:authz:policy:read"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/governance/versions:activate": {
      "post": {
        "operationId": "activatePolicyVersion",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ActivationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ActivatePolicyVersionRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "activate_policy_version",
        "x-udb-scope": [
          "udb:authz:admin"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/authz/governance/versions:rollback": {
      "post": {
        "operationId": "rollbackPolicyVersion",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ActivationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RollbackPolicyVersionRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "rollback_policy_version",
        "x-udb-scope": [
          "udb:authz:admin"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/authz/native-access": {
      "post": {
        "summary": "Stage 2: authorize and, when allowed, mint a short-lived native-access\ncontract (restricted role + scoped DSN + RLS session variables).",
        "operationId": "getNativeAccess",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1NativeAccessResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "`GetNativeAccess` runs the same `Authorize` decision and, when allowed,\nmints a short-lived contract for the caller to talk to the backend\ndirectly: a restricted role, a scoped DSN, and the exact set of\n`app.current_*` session variables the SDK must `SET LOCAL` so the\nbroker-generated RLS policies still apply. UDB stays the source of the\nauthorization decision; the native grant only carries it forward.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1NativeAccessRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "get_native_access",
        "x-udb-scope": [
          "udb:authz:get-native-access"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/policies": {
      "get": {
        "summary": "List policy rules with optional domain/subject/object filters.",
        "operationId": "listPolicyRules",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListPolicyRulesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "subject",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "object",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "activeOnly",
            "in": "query",
            "required": false,
            "type": "boolean"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "list_policy_rules",
        "x-udb-scope": [
          "udb:authz:list-policy-rules"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "operationId": "createPolicyRule",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreatePolicyRuleResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreatePolicyRuleRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "create_policy_rule",
        "x-udb-scope": [
          "udb:authz:create-policy-rule"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      },
      "put": {
        "operationId": "putAuthzPolicy",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuthMutationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1PutAuthzPolicyRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "put_authz_policy",
        "x-udb-scope": [
          "udb:authz:put-authz-policy"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/policies/{policyId}": {
      "get": {
        "summary": "Get a single policy rule by ID.",
        "operationId": "getPolicyRule",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetPolicyRuleResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "policyId",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "get_policy_rule",
        "x-udb-scope": [
          "udb:authz:get-policy-rule"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      },
      "delete": {
        "summary": "Delete a policy rule.",
        "operationId": "deletePolicyRule",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeletePolicyRuleResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "policyId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "deletedBy",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "delete_policy_rule",
        "x-udb-scope": [
          "udb:authz:delete-policy-rule"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/policies:lint": {
      "post": {
        "operationId": "lintAuthzPolicies",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1LintAuthzPoliciesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1LintAuthzPoliciesRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "lint_authz_policies",
        "x-udb-scope": [
          "udb:authz:lint-authz-policies"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/policy-bundle": {
      "post": {
        "summary": "Stage 2: return a signed policy bundle for local SDK authorization caches.",
        "operationId": "getPolicyBundle",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PolicyBundleResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "`GetPolicyBundle` serializes the live authorization snapshot (policies,\nrole bindings, relationship tuples) and signs it so an SDK can cache it\nand answer `can()` locally without a round-trip, while still being able\nto verify the bundle was issued by UDB and has not expired.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1PolicyBundleRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "get_policy_bundle",
        "x-udb-scope": [
          "udb:authz:get-policy-bundle"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/relationships": {
      "put": {
        "operationId": "putRelationship",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuthMutationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1PutRelationshipRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "put_relationship",
        "x-udb-scope": [
          "udb:authz:put-relationship"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/role-bindings": {
      "put": {
        "operationId": "putRoleBinding",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuthMutationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1PutRoleBindingRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "put_role_binding",
        "x-udb-scope": [
          "udb:authz:put-role-binding"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/roles": {
      "get": {
        "summary": "List all roles for a domain/tenant.",
        "operationId": "listRoles",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListRolesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "activeOnly",
            "in": "query",
            "required": false,
            "type": "boolean"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "list_roles",
        "x-udb-scope": [
          "udb:authz:list-roles"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "operationId": "createRole",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateRoleResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateRoleRequest"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "create_role",
        "x-udb-scope": [
          "udb:authz:create-role"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/roles/{roleId}": {
      "get": {
        "summary": "Get a role by ID.",
        "operationId": "getRole",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetRoleResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roleId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "roleCode",
            "description": "Alternative lookup",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "domain",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "get_role",
        "x-udb-scope": [
          "udb:authz:get-role"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      },
      "delete": {
        "summary": "Delete a role (soft-delete; existing assignments are revoked).",
        "operationId": "deleteRole",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteRoleResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roleId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "deletedBy",
            "in": "query",
            "required": true,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "delete_role",
        "x-udb-scope": [
          "udb:authz:delete-role"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      },
      "patch": {
        "summary": "Update a role's name, description, or active status.",
        "operationId": "updateRole",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateRoleResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roleId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthzServiceUpdateRoleBody"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "update_role",
        "x-udb-scope": [
          "udb:authz:update-role"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/users/{userId}/permissions": {
      "get": {
        "operationId": "listUserPermissions",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListUserPermissionsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "type": "string"
          },
          {
            "name": "pageSize",
            "description": "Requested page size. Defaults to 50 and is capped at the native list maximum.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListUserPermissionsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "list_user_permissions",
        "x-udb-scope": [
          "udb:authz:list-user-permissions"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/authz/users/{userId}/roles": {
      "get": {
        "summary": "List all role assignments for a user.",
        "operationId": "listUserRoles",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListUserRolesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "domain",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "activeOnly",
            "in": "query",
            "required": false,
            "type": "boolean"
          },
          {
            "name": "pageSize",
            "description": "Requested page size. Defaults to 50 and is capped at the native list maximum.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListUserRolesResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "list_user_roles",
        "x-udb-scope": [
          "udb:authz:list-user-roles"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "operationId": "assignRole",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AssignRoleResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthzServiceAssignRoleBody"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "assign_role",
        "x-udb-scope": [
          "udb:authz:assign-role"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/authz/users/{userId}/roles/{userRoleId}:revoke": {
      "post": {
        "summary": "Revoke a role from a user.",
        "operationId": "revokeRole",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RevokeRoleResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "userRoleId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AuthzServiceRevokeRoleBody"
            }
          }
        ],
        "tags": [
          "AuthzService"
        ],
        "x-udb-sdk-alias": "revoke_role",
        "x-udb-scope": [
          "udb:authz:revoke-role"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "authz",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/backups": {
      "get": {
        "summary": "List the calling tenant's backup/restore journal runs (most recent first).",
        "operationId": "listBackups",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListBackupsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "kind",
            "description": "Optional kind filter: BACKUP | RESTORE. Empty returns both.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "BackupService"
        ],
        "x-udb-sdk-alias": "list_backups",
        "x-udb-scope": [
          "udb:backup:list-backups"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "backups",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/backups/policies": {
      "get": {
        "summary": "List the calling tenant's backup retention policies.",
        "operationId": "listBackupPolicies",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListBackupPoliciesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "BackupService"
        ],
        "x-udb-sdk-alias": "list_backup_policies",
        "x-udb-scope": [
          "udb:backup:list-backup-policies"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "backups",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "Create or update the calling tenant's backup retention/schedule policy.",
        "operationId": "putBackupPolicy",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PutBackupPolicyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1PutBackupPolicyRequest"
            }
          }
        ],
        "tags": [
          "BackupService"
        ],
        "x-udb-sdk-alias": "put_backup_policy",
        "x-udb-scope": [
          "udb:backup:put-backup-policy"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "backups",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/backups/policies/{policyName}": {
      "get": {
        "summary": "Fetch a tenant's backup retention/schedule policy by name.",
        "operationId": "getBackupPolicy",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetBackupPolicyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "policyName",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "BackupService"
        ],
        "x-udb-sdk-alias": "get_backup_policy",
        "x-udb-scope": [
          "udb:backup:get-backup-policy"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "backups",
        "x-udb-operation-kind": "read_only"
      },
      "delete": {
        "summary": "Delete a tenant's backup retention policy by name.",
        "operationId": "deleteBackupPolicy",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteBackupPolicyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "policyName",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "BackupService"
        ],
        "x-udb-sdk-alias": "delete_backup_policy",
        "x-udb-scope": [
          "udb:backup:delete-backup-policy"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "backups",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/backups/{backupId}": {
      "get": {
        "summary": "Fetch one backup run plus its per-table manifest detail.",
        "operationId": "getBackup",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetBackupResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "backupId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "BackupService"
        ],
        "x-udb-sdk-alias": "get_backup",
        "x-udb-scope": [
          "udb:backup:get-backup"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "backups",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/backups:restore": {
      "post": {
        "summary": "Restore a tenant's backup into a FRESH target tenant. DESTRUCTIVE: requires\nan explicit confirmation token, the cross-tenant movement scope check, and a\ntarget tenant that holds no rows (restoring over a live tenant is refused).",
        "operationId": "restoreTenant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RestoreTenantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RestoreTenantRequest"
            }
          }
        ],
        "tags": [
          "BackupService"
        ],
        "x-udb-sdk-alias": "restore_tenant",
        "x-udb-scope": [
          "udb:backup:restore-tenant"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "backups",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/backups:start": {
      "post": {
        "summary": "Start a logical backup of the calling tenant. Enumerates tenant-owned tables\nvia the shared resolver, encrypts each table's rows to object storage, and\njournals the run. Tenant-less tables are reported as excluded.",
        "operationId": "startTenantBackup",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1StartTenantBackupResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1StartTenantBackupRequest"
            }
          }
        ],
        "tags": [
          "BackupService"
        ],
        "x-udb-sdk-alias": "start_tenant_backup",
        "x-udb-scope": [
          "udb:backup:start-tenant-backup"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "backups",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/cache/namespaces": {
      "post": {
        "summary": "Declare (or update) a namespace and its per-tenant byte budget + default TTL.",
        "operationId": "createCacheNamespace",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateNamespaceResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateNamespaceRequest"
            }
          }
        ],
        "tags": [
          "CacheService"
        ],
        "x-udb-sdk-alias": "create_cache_namespace",
        "x-udb-scope": [
          "udb:cache:create-namespace"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "cache",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/cache/namespaces/{namespace}/stats": {
      "get": {
        "summary": "Report a namespace's current used-bytes counter, configured budget, and item\ncount for the caller's tenant.",
        "operationId": "getCacheNamespaceStats",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetNamespaceStatsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "namespace",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "CacheService"
        ],
        "x-udb-sdk-alias": "get_cache_namespace_stats",
        "x-udb-scope": [
          "udb:cache:get-namespace-stats"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "cache",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/cache/namespaces/{namespace}:flush": {
      "post": {
        "summary": "Flush an entire namespace for the caller's tenant (SCAN+DEL sweep) and emit\nan invalidation event. DESTRUCTIVE — gated by a confirmation token.",
        "operationId": "deleteCacheNamespace",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteNamespaceResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "namespace",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/CacheServiceDeleteNamespaceBody"
            }
          }
        ],
        "tags": [
          "CacheService"
        ],
        "x-udb-sdk-alias": "delete_cache_namespace",
        "x-udb-scope": [
          "udb:cache:delete-namespace"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "cache",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/cache/{namespace}/{key}": {
      "get": {
        "summary": "Read a value from a namespaced cache key. Tenant-scoped: the key is derived\nfrom the verified claim tenant, so a caller can never read another tenant's\nentry by spoofing the body tenant_id.",
        "operationId": "cacheNamespaceGet",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "namespace",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "key",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "CacheService"
        ],
        "x-udb-sdk-alias": "cache_get",
        "x-udb-scope": [
          "udb:cache:get"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "cache",
        "x-udb-operation-kind": "read_only"
      },
      "delete": {
        "summary": "Delete a single namespaced key. Idempotent.",
        "operationId": "cacheNamespaceDelete",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "namespace",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "key",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "CacheService"
        ],
        "x-udb-sdk-alias": "cache_delete",
        "x-udb-scope": [
          "udb:cache:delete"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "cache",
        "x-udb-operation-kind": "mutation"
      },
      "put": {
        "summary": "Write a value with an optional TTL. Bounded: a write that would push the\nnamespace over its per-tenant `max_bytes` budget fails closed with\n`resource_exhausted`.",
        "operationId": "cacheNamespaceSet",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SetResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "namespace",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "key",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/CacheServiceSetBody"
            }
          }
        ],
        "tags": [
          "CacheService"
        ],
        "x-udb-sdk-alias": "cache_set",
        "x-udb-scope": [
          "udb:cache:set"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "cache",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/cache/{namespace}:scan": {
      "get": {
        "summary": "Cursor-paged scan over a namespace key prefix. Implemented with Redis SCAN\n(never KEYS), so it never blocks the server on a large keyspace.",
        "operationId": "cacheNamespaceScan",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScanResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "namespace",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "keyPrefix",
            "description": "Key prefix WITHIN the namespace (the tenant/namespace prefix is added\nserver-side from the verified claim, never supplied by the caller).",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "limit",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque Redis SCAN cursor from a prior page (\"\" / \"0\" starts a fresh scan).",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "CacheService"
        ],
        "x-udb-sdk-alias": "cache_scan",
        "x-udb-scope": [
          "udb:cache:scan"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "cache",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/config/flags": {
      "get": {
        "summary": "List a tenant's flags, optionally narrowed to a project and/or environment.",
        "operationId": "listFlags",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListFlagsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "projectId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "environment",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "limit",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int64"
          },
          {
            "name": "pageSize",
            "description": "Requested page size. Defaults to limit/default-list-limit and is capped at\nthe native list maximum.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListFlagsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "ConfigService"
        ],
        "x-udb-sdk-alias": "list_flags",
        "x-udb-scope": [
          "udb:config:list-flags"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "config",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/config/flags/{flagKey}": {
      "get": {
        "summary": "Fetch a single flag's stored definition at an exact (tenant, project,\nenvironment, key) scope. Read-only; performs no rollout evaluation.",
        "operationId": "getFlag",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetFlagResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "flagKey",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "projectId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "environment",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "ConfigService"
        ],
        "x-udb-sdk-alias": "get_flag",
        "x-udb-scope": [
          "udb:config:get-flag"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "config",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/config/flags:delete": {
      "post": {
        "summary": "Delete a flag at an exact scope. Destructive; bumps the revision in the\nemitted change event.",
        "operationId": "deleteFlag",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteFlagResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteFlagRequest"
            }
          }
        ],
        "tags": [
          "ConfigService"
        ],
        "x-udb-sdk-alias": "delete_flag",
        "x-udb-scope": [
          "udb:config:delete-flag"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "config",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/config/flags:evaluate": {
      "post": {
        "summary": "Evaluate a set of flag keys for an evaluation context. The server applies the\nSAME pure algorithm the SDK uses (scope precedence + stable-hash percentage\nrollout) and returns the resolved typed values plus a server-authoritative\ncache TTL and the observed config revision. Read-only.",
        "operationId": "evaluateFlags",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1EvaluateFlagsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1EvaluateFlagsRequest"
            }
          }
        ],
        "tags": [
          "ConfigService"
        ],
        "x-udb-sdk-alias": "evaluate_flags",
        "x-udb-scope": [
          "udb:config:evaluate-flags"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "config",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/config/flags:put": {
      "post": {
        "summary": "Create or update a flag at a (tenant, project, environment) scope. Bumps the\nflag's monotone revision and emits `udb.config.flag.changed.v1`.",
        "operationId": "putFlag",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PutFlagResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1PutFlagRequest"
            }
          }
        ],
        "tags": [
          "ConfigService"
        ],
        "x-udb-sdk-alias": "put_flag",
        "x-udb-scope": [
          "udb:config:put-flag"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "config",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/control/node-states": {
      "get": {
        "summary": "── Admin visibility ──────────────────────────────────────────────────────",
        "operationId": "listNodeStates",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListNodeStatesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "nodeId",
            "description": "Optional node filter. Empty == all nodes.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "resourceType",
            "description": "Optional resource-type filter (UNSPECIFIED == all types).\n\n - RESOURCE_TYPE_ROUTING_POLICY: Request routing / backend selection policy (references backend targets).\n - RESOURCE_TYPE_METHOD_SECURITY_POLICY: Per-RPC method-security policy (the proto endpoint_security map).\n - RESOURCE_TYPE_RLS_TENANT_POLICY: Row-level-security / tenant isolation policy (references backend targets).\n - RESOURCE_TYPE_NATIVE_SERVICE_ENABLEMENT: Which native control-plane services are enabled on a node.\n - RESOURCE_TYPE_BACKEND_TARGET_DEFINITION: Backend target/cluster definitions — the \"definitions\" that routing and\nRLS policies reference. Pushed BEFORE the referencing policies.",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "RESOURCE_TYPE_UNSPECIFIED",
              "RESOURCE_TYPE_ROUTING_POLICY",
              "RESOURCE_TYPE_METHOD_SECURITY_POLICY",
              "RESOURCE_TYPE_RLS_TENANT_POLICY",
              "RESOURCE_TYPE_NATIVE_SERVICE_ENABLEMENT",
              "RESOURCE_TYPE_BACKEND_TARGET_DEFINITION"
            ],
            "default": "RESOURCE_TYPE_UNSPECIFIED"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "ControlPlaneService"
        ],
        "x-udb-sdk-alias": "list_node_states",
        "x-udb-scope": [
          "udb:control:list-node-states"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "control",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/control/node-states/{nodeId}:ackStatus": {
      "post": {
        "operationId": "ackStatus",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AckStatusResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "nodeId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ControlPlaneServiceAckStatusBody"
            }
          }
        ],
        "tags": [
          "ControlPlaneService"
        ],
        "x-udb-sdk-alias": "ack_status",
        "x-udb-scope": [
          "udb:control:ack-status"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "control",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/control/node-states/{nodeId}:rollbackResources": {
      "post": {
        "summary": "── Rollback a node/resource-type to a retained served snapshot ────────────",
        "operationId": "rollbackResources",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RollbackResourcesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "nodeId",
            "description": "The node whose retained served snapshots provide the rollback target set.",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ControlPlaneServiceRollbackResourcesBody"
            }
          }
        ],
        "tags": [
          "ControlPlaneService"
        ],
        "x-udb-sdk-alias": "rollback_resources",
        "x-udb-scope": [
          "udb:control:rollback-resources"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "control",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/control/resources": {
      "get": {
        "summary": "── On-demand fetch (incl. by tenant) ─────────────────────────────────────",
        "operationId": "getResources",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetResourcesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "resourceType",
            "description": " - RESOURCE_TYPE_ROUTING_POLICY: Request routing / backend selection policy (references backend targets).\n - RESOURCE_TYPE_METHOD_SECURITY_POLICY: Per-RPC method-security policy (the proto endpoint_security map).\n - RESOURCE_TYPE_RLS_TENANT_POLICY: Row-level-security / tenant isolation policy (references backend targets).\n - RESOURCE_TYPE_NATIVE_SERVICE_ENABLEMENT: Which native control-plane services are enabled on a node.\n - RESOURCE_TYPE_BACKEND_TARGET_DEFINITION: Backend target/cluster definitions — the \"definitions\" that routing and\nRLS policies reference. Pushed BEFORE the referencing policies.",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "RESOURCE_TYPE_UNSPECIFIED",
              "RESOURCE_TYPE_ROUTING_POLICY",
              "RESOURCE_TYPE_METHOD_SECURITY_POLICY",
              "RESOURCE_TYPE_RLS_TENANT_POLICY",
              "RESOURCE_TYPE_NATIVE_SERVICE_ENABLEMENT",
              "RESOURCE_TYPE_BACKEND_TARGET_DEFINITION"
            ],
            "default": "RESOURCE_TYPE_UNSPECIFIED"
          },
          {
            "name": "tenantId",
            "description": "Optional tenant filter for on-demand tenant-policy fetch. Empty == fleet-wide\nresources only (NULL tenant rows); set == fleet-wide + that tenant's rows.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "resourceNames",
            "description": "Optional explicit name filter. Empty == all matching the type/tenant.",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "ControlPlaneService"
        ],
        "x-udb-sdk-alias": "get_resources",
        "x-udb-scope": [
          "udb:control:get-resources"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "control",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/embedding/documents:batchIngest": {
      "post": {
        "operationId": "ingestEmbeddingDocumentBatch",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1IngestDocumentBatchResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1IngestDocumentBatchRequest"
            }
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "ingest_document_batch",
        "x-udb-scope": [
          "udb:embedding:ingest-document"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/embedding/documents:ingest": {
      "post": {
        "operationId": "ingestEmbeddingDocument",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1IngestDocumentResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1IngestDocumentRequest"
            }
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "ingest_document",
        "x-udb-scope": [
          "udb:embedding:ingest-document"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/embedding/jobs/{jobId}": {
      "get": {
        "operationId": "getEmbeddingJobStatus",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetEmbeddingJobStatusResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "jobId",
            "description": "Canonical job id returned by Backfill/IngestDocument (server-assigned UUID).",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "get_job_status",
        "x-udb-scope": [
          "udb:embedding:get-job"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/embedding/jobs/{jobId}/work-items": {
      "get": {
        "operationId": "listEmbeddingWorkItems",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListEmbeddingWorkItemsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "jobId",
            "description": "Canonical job id returned by Backfill/IngestDocument (server-assigned UUID).",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "status",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListEmbeddingWorkItemsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "list_work_items",
        "x-udb-scope": [
          "udb:embedding:list-work"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/embedding/models": {
      "get": {
        "operationId": "listEmbeddingModels",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListModelsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "status",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "EMBEDDING_MODEL_STATUS_UNSPECIFIED",
              "EMBEDDING_MODEL_STATUS_ACTIVE",
              "EMBEDDING_MODEL_STATUS_DEPRECATED",
              "EMBEDDING_MODEL_STATUS_RETIRED"
            ],
            "default": "EMBEDDING_MODEL_STATUS_UNSPECIFIED"
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "list_models",
        "x-udb-scope": [
          "udb:embedding:list-models"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/embedding/models:cutover": {
      "post": {
        "operationId": "cutoverEmbeddingModelAlias",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CutoverModelAliasResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CutoverModelAliasRequest"
            }
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "cutover_model_alias",
        "x-udb-scope": [
          "udb:embedding:cutover-model"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/embedding/models:delete": {
      "post": {
        "operationId": "deleteEmbeddingModel",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteModelResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteModelRequest"
            }
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "delete_model",
        "x-udb-scope": [
          "udb:embedding:delete-model"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/embedding/models:register": {
      "post": {
        "operationId": "registerEmbeddingModel",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RegisterModelResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RegisterModelRequest"
            }
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "register_model",
        "x-udb-scope": [
          "udb:embedding:register-model"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/embedding/models:setStatus": {
      "post": {
        "operationId": "setEmbeddingModelStatus",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SetModelStatusResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SetModelStatusRequest"
            }
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "set_model_status",
        "x-udb-scope": [
          "udb:embedding:update-model"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/embedding/sources": {
      "get": {
        "summary": "List the calling tenant's registered sources.",
        "operationId": "listEmbeddingSources",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListSourcesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListSourcesResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "list_sources",
        "x-udb-scope": [
          "udb:embedding:list-sources"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/embedding/sources:backfill": {
      "post": {
        "summary": "Enqueue embedding work for the source's EXISTING rows. The per-row work\nenumeration runs in the leader-spawned work emitter, which calls the same\n`udb.embedding.work.v1` emit path the CDC change handler uses.",
        "operationId": "backfillEmbeddingSource",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1BackfillResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1BackfillRequest"
            }
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "backfill",
        "x-udb-scope": [
          "udb:embedding:backfill"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/embedding/sources:delete": {
      "post": {
        "summary": "Delete a tenant-scoped source registration (destructive: stops indexing on\nchange; the engine collection teardown runs on the follow-up worker).",
        "operationId": "deleteEmbeddingSource",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteSourceResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteSourceRequest"
            }
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "delete_source",
        "x-udb-scope": [
          "udb:embedding:delete-source"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/embedding/sources:register": {
      "post": {
        "summary": "Register a tenant-scoped source to vector-index on change. Fails closed\n(failed_precondition) when the source table has no resolvable tenant column.",
        "operationId": "registerEmbeddingSource",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RegisterSourceResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RegisterSourceRequest"
            }
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "register_source",
        "x-udb-scope": [
          "udb:embedding:register-source"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/embedding:retrieve": {
      "post": {
        "summary": "Deadline-bounded semantic search over a source's vector collection. DELEGATES\nto the SearchService (9.5) hybrid-search seam with a server-side tenant filter\ninjected from the verified claim. The broker never embeds the query (the\ncaller supplies an already-embedded `query_vector`); it never issues a raw\nengine query. Returns `deadline_exceeded` if the gRPC deadline is past.",
        "operationId": "retrieveEmbedding",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RetrieveResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RetrieveRequest"
            }
          }
        ],
        "tags": [
          "EmbeddingService"
        ],
        "x-udb-sdk-alias": "retrieve",
        "x-udb-scope": [
          "udb:embedding:retrieve"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "embedding",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/idp/external-identities": {
      "get": {
        "operationId": "listExternalIdentities",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListExternalIdentitiesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "providerId",
            "description": "empty = all providers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "userId",
            "description": "empty = all users",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "list_external_identities",
        "x-udb-scope": [
          "udb:idp:list-external-identities"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/idp/external-identities/{externalIdentityId}:unlink": {
      "post": {
        "operationId": "unlinkIdentity",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UnlinkIdentityResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "externalIdentityId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceUnlinkIdentityBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "unlink_identity",
        "x-udb-scope": [
          "udb:idp:unlink-identity"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/external-identities:link": {
      "post": {
        "operationId": "linkIdentity",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1LinkIdentityResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "Explicitly link an IdP subject to an existing UDB user.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1LinkIdentityRequest"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "link_identity",
        "x-udb-scope": [
          "udb:idp:link-identity"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/providers": {
      "get": {
        "operationId": "listProviders",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListProvidersResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "kind",
            "description": "unspecified = all\n\n - IDP_KIND_NATIVE: UDB native password/MFA\n - IDP_KIND_OIDC: OpenID Connect (discovery + JWKS)\n - IDP_KIND_SAML: SAML 2.0 web SSO\n - IDP_KIND_LDAP: LDAP / Active Directory bind\n - IDP_KIND_CUSTOM_JWT: Bring-your-own signed JWT (jwks_url + claims)\n - IDP_KIND_EXTERNAL_SESSION: Upstream session handed off to UDB",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "IDP_KIND_UNSPECIFIED",
              "IDP_KIND_NATIVE",
              "IDP_KIND_OIDC",
              "IDP_KIND_SAML",
              "IDP_KIND_LDAP",
              "IDP_KIND_CUSTOM_JWT",
              "IDP_KIND_EXTERNAL_SESSION"
            ],
            "default": "IDP_KIND_UNSPECIFIED"
          },
          {
            "name": "enabledOnly",
            "in": "query",
            "required": false,
            "type": "boolean"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "list_providers",
        "x-udb-scope": [
          "udb:idp:list-providers"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "── Provider administration (J2.6) ────────────────────────────────────────",
        "operationId": "createProvider",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateProviderResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateProviderRequest"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "create_provider",
        "x-udb-scope": [
          "udb:idp:create-provider"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/providers/{providerId}": {
      "get": {
        "operationId": "getProvider",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetProviderResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "get_provider",
        "x-udb-scope": [
          "udb:idp:get-provider"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "read_only"
      },
      "patch": {
        "operationId": "updateProvider",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateProviderResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceUpdateProviderBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "update_provider",
        "x-udb-scope": [
          "udb:idp:update-provider"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/providers/{providerId}:disable": {
      "post": {
        "operationId": "disableProvider",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DisableProviderResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceDisableProviderBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "disable_provider",
        "x-udb-scope": [
          "udb:idp:disable-provider"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/providers/{providerId}:importSamlMetadata": {
      "post": {
        "summary": "── SAML 2.0 (J2.2) ───────────────────────────────────────────────────────",
        "operationId": "importSamlMetadata",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ImportSamlMetadataResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceImportSamlMetadataBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "import_saml_metadata",
        "x-udb-scope": [
          "udb:idp:import-saml-metadata"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/providers/{providerId}:previewClaimMapping": {
      "post": {
        "operationId": "previewClaimMapping",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PreviewClaimMappingResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServicePreviewClaimMappingBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "preview_claim_mapping",
        "x-udb-scope": [
          "udb:idp:preview-claim-mapping"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/idp/providers/{providerId}:previewGroupMapping": {
      "post": {
        "operationId": "previewGroupMapping",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PreviewGroupMappingResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServicePreviewGroupMappingBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "preview_group_mapping",
        "x-udb-scope": [
          "udb:idp:preview-group-mapping"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/idp/providers/{providerId}:refreshJwks": {
      "post": {
        "operationId": "forceJwksRefresh",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ForceJwksRefreshResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceForceJwksRefreshBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "force_jwks_refresh",
        "x-udb-scope": [
          "udb:idp:force-jwks-refresh"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/providers/{providerId}:resolveIdentity": {
      "post": {
        "summary": "── JIT provisioning + assurance (J2.4 / J2.5) ────────────────────────────",
        "operationId": "resolveExternalIdentity",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ResolveExternalIdentityResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceResolveExternalIdentityBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "resolve_external_identity",
        "x-udb-scope": [
          "udb:idp:resolve-external-identity"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/providers/{providerId}:samlAcs": {
      "post": {
        "operationId": "samlAcs",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SamlAcsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceSamlAcsBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "saml_acs",
        "x-udb-scope": [
          "udb:idp:saml-acs"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/providers/{providerId}:startSamlLogin": {
      "post": {
        "operationId": "startSamlLogin",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1StartSamlLoginResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceStartSamlLoginBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "start_saml_login",
        "x-udb-scope": [
          "udb:idp:start-saml-login"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/providers/{providerId}:testDiscovery": {
      "post": {
        "operationId": "testProviderDiscovery",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1TestProviderDiscoveryResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceTestProviderDiscoveryBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "test_provider_discovery",
        "x-udb-scope": [
          "udb:idp:test-provider-discovery"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/idp/scim/{providerId}/Groups": {
      "get": {
        "operationId": "scimListGroups",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimListGroupsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "filter",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_list_groups",
        "x-udb-scope": [
          "udb:idp:scim-list-groups"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      },
      "post": {
        "operationId": "scimCreateGroup",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimCreateGroupResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceScimCreateGroupBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_create_group",
        "x-udb-scope": [
          "udb:idp:scim-create-group"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/scim/{providerId}/Groups/{scimGroupId}": {
      "get": {
        "operationId": "scimGetGroup",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimGetGroupResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "scimGroupId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_get_group",
        "x-udb-scope": [
          "udb:idp:scim-get-group"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      },
      "delete": {
        "operationId": "scimDeleteGroup",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimDeleteGroupResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "scimGroupId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_delete_group",
        "x-udb-scope": [
          "udb:idp:scim-delete-group"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      },
      "patch": {
        "operationId": "scimPatchGroup",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimPatchGroupResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "scimGroupId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceScimPatchGroupBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_patch_group",
        "x-udb-scope": [
          "udb:idp:scim-patch-group"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/scim/{providerId}/Users": {
      "get": {
        "operationId": "scimListUsers",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimListUsersResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "filter",
            "description": "SCIM filter, e.g. userName eq \"x\"",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_list_users",
        "x-udb-scope": [
          "udb:idp:scim-list-users"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      },
      "post": {
        "summary": "── SCIM 2.0 (J2.3) ───────────────────────────────────────────────────────",
        "operationId": "scimCreateUser",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimCreateUserResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceScimCreateUserBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_create_user",
        "x-udb-scope": [
          "udb:idp:scim-create-user"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/idp/scim/{providerId}/Users/{scimUserId}": {
      "get": {
        "operationId": "scimGetUser",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimGetUserResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "scimUserId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_get_user",
        "x-udb-scope": [
          "udb:idp:scim-get-user"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      },
      "delete": {
        "operationId": "scimDeleteUser",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimDeleteUserResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "scimUserId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.tenantId",
            "description": "Tenant or account boundary chosen by the caller or resolved by UDB.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.organizationId",
            "description": "Optional owning organization/workspace above the tenant boundary.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.projectId",
            "description": "Project/application namespace inside the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.environment",
            "description": "Deployment environment, for example prod, staging, dev, or test.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.region",
            "description": "Region, shard, or residency boundary when routing matters.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.partitionId",
            "description": "Optional data partition or workspace identifier for fine-grained isolation.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.accessSurface",
            "description": "UI/API surface or workload channel such as web, mobile, api, worker.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.tenant.attributes",
            "description": "Consumer-defined labels for policy routing and audit enrichment.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.requestId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.correlationId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.headers",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.spanId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.ipAddress",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.userAgent",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.timestamp",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "date-time"
          },
          {
            "name": "context.principalId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.serviceIdentity",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.scopes",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.roles",
            "in": "query",
            "required": false,
            "type": "array",
            "items": {
              "type": "string"
            },
            "collectionFormat": "multi"
          },
          {
            "name": "context.purpose",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.idempotencyKey",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.clientCatalogVersion",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.consistency",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.attributes",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "context.traceparent",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_delete_user",
        "x-udb-scope": [
          "udb:idp:scim-delete-user"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      },
      "put": {
        "operationId": "scimReplaceUser",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimReplaceUserResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "scimUserId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceScimReplaceUserBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_replace_user",
        "x-udb-scope": [
          "udb:idp:scim-replace-user"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      },
      "patch": {
        "operationId": "scimPatchUser",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ScimPatchUserResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "providerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "scimUserId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IdentityProviderServiceScimPatchUserBody"
            }
          }
        ],
        "tags": [
          "IdentityProviderService"
        ],
        "x-udb-sdk-alias": "scim_patch_user",
        "x-udb-scope": [
          "udb:idp:scim-patch-user"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "idp",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/livequery:subscribe": {
      "post": {
        "summary": "Subscribe to a tenant-scoped live query. SERVER-STREAMING: the first message\ncarries the initial Snapshot (the current rows matching the IR filter, read\nthrough the mediated path with the tenant predicate injected server-side);\nevery subsequent message carries a single Change delta. Fails closed\n(failed_precondition) when the source entity has no resolvable tenant column.",
        "operationId": "liveQuerySubscribe",
        "responses": {
          "200": {
            "description": "A successful response.(streaming responses)",
            "schema": {
              "type": "object",
              "properties": {
                "result": {
                  "$ref": "#/definitions/v1SubscribeResponse"
                },
                "error": {
                  "$ref": "#/definitions/rpcStatus"
                }
              },
              "title": "Stream result of v1SubscribeResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SubscribeRequest"
            }
          }
        ],
        "tags": [
          "LiveQueryService"
        ],
        "x-udb-sdk-alias": "subscribe",
        "x-udb-scope": [
          "udb:livequery:subscribe"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "livequery",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/locks": {
      "get": {
        "summary": "List the caller tenant's locks, optionally narrowed by status. Paginated\n(page_size + opaque page_token). Read-only.",
        "operationId": "listLocks",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListLocksResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "statusFilter",
            "description": "Optional exact status filter (e.g. HELD, RELEASED, EXPIRED); empty = all.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListLocksResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "LockService"
        ],
        "x-udb-sdk-alias": "list_locks",
        "x-udb-scope": [
          "udb:lock:list-locks"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "locks",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/locks/{lockName}": {
      "get": {
        "summary": "Fetch a single lock by name within the caller's tenant. Read-only; an absent\nlock returns found=false (not an error) — a tenant-scoped read miss is normal.",
        "operationId": "getLock",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetLockResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "lockName",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "LockService"
        ],
        "x-udb-sdk-alias": "get_lock",
        "x-udb-scope": [
          "udb:lock:get-lock"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "locks",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/locks:acquire": {
      "post": {
        "summary": "Acquire a distributed lock. Quota-aware: a tenant cannot exceed its active\nlock budget. Returns the monotone fencing token the holder must present on\nRenew/Release.",
        "operationId": "acquireLock",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AcquireLockResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1AcquireLockRequest"
            }
          }
        ],
        "tags": [
          "LockService"
        ],
        "x-udb-sdk-alias": "acquire_lock",
        "x-udb-scope": [
          "udb:lock:acquire-lock"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "locks",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/locks:release": {
      "post": {
        "summary": "Release a lock the caller currently holds. The presented fencing token must\nnot be stale; a lower token is rejected.",
        "operationId": "releaseLock",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ReleaseLockResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ReleaseLockRequest"
            }
          }
        ],
        "tags": [
          "LockService"
        ],
        "x-udb-sdk-alias": "release_lock",
        "x-udb-scope": [
          "udb:lock:release-lock"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "locks",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/locks:renew": {
      "post": {
        "summary": "Renew (extend the lease of) a lock the caller currently holds. The presented\nfencing token must not be stale; a lower token is rejected.",
        "operationId": "renewLock",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RenewLockResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RenewLockRequest"
            }
          }
        ],
        "tags": [
          "LockService"
        ],
        "x-udb-sdk-alias": "renew_lock",
        "x-udb-scope": [
          "udb:lock:renew-lock"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "locks",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/metering/quotas": {
      "get": {
        "summary": "List a tenant's quota rules, optionally narrowed to a project.",
        "operationId": "listQuotas",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListQuotasResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "projectId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "limit",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int64"
          },
          {
            "name": "pageSize",
            "description": "Requested page size. Defaults to limit/default-list-limit and is capped at\nthe native list maximum.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListQuotasResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "MeteringService"
        ],
        "x-udb-sdk-alias": "list_quotas",
        "x-udb-scope": [
          "udb:metering:list-quotas"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "metering",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/metering/quotas/{metric}": {
      "get": {
        "summary": "Fetch a single quota rule at an exact (tenant, project, metric) scope.",
        "operationId": "getQuota",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetQuotaResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "metric",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "projectId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "MeteringService"
        ],
        "x-udb-sdk-alias": "get_quota",
        "x-udb-scope": [
          "udb:metering:get-quota"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "metering",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/metering/quotas:check": {
      "post": {
        "summary": "Check a quota: sum durable usage in the rule's window and compare against the\nlimit. Returns {allowed, used, limit, remaining}. The ingest hook remains\nbest-effort, but explicit quota checks fail closed when the durable aggregate\nis unavailable, so an outage cannot silently bypass an enabled quota.",
        "operationId": "checkQuota",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CheckQuotaResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CheckQuotaRequest"
            }
          }
        ],
        "tags": [
          "MeteringService"
        ],
        "x-udb-sdk-alias": "check_quota",
        "x-udb-scope": [
          "udb:metering:check-quota"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "metering",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/metering/quotas:put": {
      "post": {
        "summary": "Create or update a quota rule at a (tenant, project, metric) scope. Bumps the\nrule's monotone revision and emits `udb.metering.quota.changed.v1`.",
        "operationId": "putQuota",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PutQuotaResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1PutQuotaRequest"
            }
          }
        ],
        "tags": [
          "MeteringService"
        ],
        "x-udb-sdk-alias": "put_quota",
        "x-udb-scope": [
          "udb:metering:put-quota"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "metering",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/metering/usage:query": {
      "post": {
        "summary": "Aggregate a tenant's usage for a metric over a rolling window (durable SUM).",
        "operationId": "queryUsage",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1QueryUsageResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1QueryUsageRequest"
            }
          }
        ],
        "tags": [
          "MeteringService"
        ],
        "x-udb-sdk-alias": "query_usage",
        "x-udb-scope": [
          "udb:metering:query-usage"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "metering",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/metering/usage:record": {
      "post": {
        "summary": "Explicitly ingest a usage event. Durable append (single INSERT, no read);\nattribution-only — it never blocks the caller's real operation.",
        "operationId": "recordUsage",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RecordUsageResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RecordUsageRequest"
            }
          }
        ],
        "tags": [
          "MeteringService"
        ],
        "x-udb-sdk-alias": "record_usage",
        "x-udb-scope": [
          "udb:metering:record-usage"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "metering",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/notifications": {
      "get": {
        "summary": "List notification logs with rich filters.",
        "operationId": "listNotifications",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListNotificationsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "recipientId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "projectId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "resourceType",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "resourceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "eventType",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "channel",
            "description": " - NOTIFICATION_CHANNEL_PUSH: Mobile push via FCM/APNs\n - NOTIFICATION_CHANNEL_IN_APP: In-app notification bell\n - NOTIFICATION_CHANNEL_WEBHOOK: Outbound HTTP webhook",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "NOTIFICATION_CHANNEL_UNSPECIFIED",
              "NOTIFICATION_CHANNEL_EMAIL",
              "NOTIFICATION_CHANNEL_SMS",
              "NOTIFICATION_CHANNEL_PUSH",
              "NOTIFICATION_CHANNEL_IN_APP",
              "NOTIFICATION_CHANNEL_WEBHOOK"
            ],
            "default": "NOTIFICATION_CHANNEL_UNSPECIFIED"
          },
          {
            "name": "status",
            "description": " - NOTIFICATION_STATUS_SUPPRESSED: Rate-limited or user preference suppressed",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "NOTIFICATION_STATUS_UNSPECIFIED",
              "NOTIFICATION_STATUS_PENDING",
              "NOTIFICATION_STATUS_SENT",
              "NOTIFICATION_STATUS_DELIVERED",
              "NOTIFICATION_STATUS_FAILED",
              "NOTIFICATION_STATUS_SUPPRESSED"
            ],
            "default": "NOTIFICATION_STATUS_UNSPECIFIED"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "list_notifications",
        "x-udb-scope": [
          "udb:notification:list-notifications"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "Send a notification (or enqueue it for async delivery).",
        "operationId": "sendNotification",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SendNotificationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SendNotificationRequest"
            }
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "send_notification",
        "x-udb-scope": [
          "udb:notification:send-notification"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/notifications/preferences/{userId}": {
      "get": {
        "summary": "List all preferences for a user.",
        "operationId": "listPreferences",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListPreferencesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "list_preferences",
        "x-udb-scope": [
          "udb:notification:list-preferences"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/notifications/preferences/{userId}/{channel}": {
      "get": {
        "summary": "Get a single preference entry.",
        "operationId": "getPreference",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetPreferenceResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "channel",
            "in": "path",
            "required": true,
            "type": "string",
            "enum": [
              "NOTIFICATION_CHANNEL_UNSPECIFIED",
              "NOTIFICATION_CHANNEL_EMAIL",
              "NOTIFICATION_CHANNEL_SMS",
              "NOTIFICATION_CHANNEL_PUSH",
              "NOTIFICATION_CHANNEL_IN_APP",
              "NOTIFICATION_CHANNEL_WEBHOOK"
            ]
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "eventType",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "get_preference",
        "x-udb-scope": [
          "udb:notification:get-preference"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "read_only"
      },
      "put": {
        "summary": "Set (upsert) a per-user channel/event opt-out preference.",
        "operationId": "setPreference",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SetPreferenceResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "userId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "channel",
            "in": "path",
            "required": true,
            "type": "string",
            "enum": [
              "NOTIFICATION_CHANNEL_UNSPECIFIED",
              "NOTIFICATION_CHANNEL_EMAIL",
              "NOTIFICATION_CHANNEL_SMS",
              "NOTIFICATION_CHANNEL_PUSH",
              "NOTIFICATION_CHANNEL_IN_APP",
              "NOTIFICATION_CHANNEL_WEBHOOK"
            ]
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/NotificationServiceSetPreferenceBody"
            }
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "set_preference",
        "x-udb-scope": [
          "udb:notification:set-preference"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/notifications/stats": {
      "get": {
        "summary": "Get delivery statistics.",
        "operationId": "getDeliveryStats",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetDeliveryStatsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "eventType",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "dateFrom",
            "description": "YYYY-MM-DD",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "dateTo",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "get_delivery_stats",
        "x-udb-scope": [
          "udb:notification:get-delivery-stats"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/notifications/templates": {
      "get": {
        "summary": "List all templates.",
        "operationId": "listTemplates",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListTemplatesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "eventType",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "channel",
            "description": " - NOTIFICATION_CHANNEL_PUSH: Mobile push via FCM/APNs\n - NOTIFICATION_CHANNEL_IN_APP: In-app notification bell\n - NOTIFICATION_CHANNEL_WEBHOOK: Outbound HTTP webhook",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "NOTIFICATION_CHANNEL_UNSPECIFIED",
              "NOTIFICATION_CHANNEL_EMAIL",
              "NOTIFICATION_CHANNEL_SMS",
              "NOTIFICATION_CHANNEL_PUSH",
              "NOTIFICATION_CHANNEL_IN_APP",
              "NOTIFICATION_CHANNEL_WEBHOOK"
            ],
            "default": "NOTIFICATION_CHANNEL_UNSPECIFIED"
          },
          {
            "name": "activeOnly",
            "in": "query",
            "required": false,
            "type": "boolean"
          },
          {
            "name": "page.page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "page.pageToken",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "list_templates",
        "x-udb-scope": [
          "udb:notification:list-templates"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/notifications/templates/{eventType}/{channel}": {
      "get": {
        "summary": "Get a template by event_type + channel + locale.",
        "operationId": "getTemplate",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetTemplateResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "eventType",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "channel",
            "in": "path",
            "required": true,
            "type": "string",
            "enum": [
              "NOTIFICATION_CHANNEL_UNSPECIFIED",
              "NOTIFICATION_CHANNEL_EMAIL",
              "NOTIFICATION_CHANNEL_SMS",
              "NOTIFICATION_CHANNEL_PUSH",
              "NOTIFICATION_CHANNEL_IN_APP",
              "NOTIFICATION_CHANNEL_WEBHOOK"
            ]
          },
          {
            "name": "locale",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "get_template",
        "x-udb-scope": [
          "udb:notification:get-template"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "read_only"
      },
      "put": {
        "summary": "Upsert a notification template.",
        "operationId": "upsertTemplate",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpsertTemplateResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "eventType",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "channel",
            "in": "path",
            "required": true,
            "type": "string",
            "enum": [
              "NOTIFICATION_CHANNEL_UNSPECIFIED",
              "NOTIFICATION_CHANNEL_EMAIL",
              "NOTIFICATION_CHANNEL_SMS",
              "NOTIFICATION_CHANNEL_PUSH",
              "NOTIFICATION_CHANNEL_IN_APP",
              "NOTIFICATION_CHANNEL_WEBHOOK"
            ]
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/NotificationServiceUpsertTemplateBody"
            }
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "upsert_template",
        "x-udb-scope": [
          "udb:notification:upsert-template"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/notifications/{logId}": {
      "get": {
        "summary": "Get delivery status for a specific log entry.",
        "operationId": "getNotification",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetNotificationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "logId",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "get_notification",
        "x-udb-scope": [
          "udb:notification:get-notification"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/notifications/{logId}:report-delivery": {
      "post": {
        "summary": "Report the terminal per-channel delivery outcome for a sent notification.\nInternal seam: the leader-elected delivery worker — or a provider webhook\nbridge — reports queued/sent/delivered/failed; the handler upserts the\nNotificationDeliveryAttempt row and emits `udb.notification.delivery.<status>.v1`.",
        "operationId": "reportDelivery",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ReportDeliveryResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "logId",
            "description": "The NotificationLog (intent) this outcome is for.",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/NotificationServiceReportDeliveryBody"
            }
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "report_delivery",
        "x-udb-scope": [
          "udb:notification:report-delivery"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/notifications/{logId}:retry": {
      "post": {
        "summary": "Retry a failed notification.",
        "operationId": "retryNotification",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RetryNotificationResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "logId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/NotificationServiceRetryNotificationBody"
            }
          }
        ],
        "tags": [
          "NotificationService"
        ],
        "x-udb-sdk-alias": "retry_notification",
        "x-udb-scope": [
          "udb:notification:retry-notification"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "notifications",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/scheduler/jobs": {
      "get": {
        "summary": "List jobs for the caller's tenant.",
        "operationId": "listJobs",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListJobsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "status",
            "description": "Optional status filter (\"ACTIVE\"/\"PAUSED\"/\"COMPLETED\"/\"DEAD\"); blank = all.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListJobsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "SchedulerService"
        ],
        "x-udb-sdk-alias": "list_jobs",
        "x-udb-scope": [
          "udb:scheduler:list-jobs"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "scheduler",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "Create a cron or one-shot job.",
        "operationId": "createJob",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateJobResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateJobRequest"
            }
          }
        ],
        "tags": [
          "SchedulerService"
        ],
        "x-udb-sdk-alias": "create_job",
        "x-udb-scope": [
          "udb:scheduler:create-job"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "scheduler",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/scheduler/jobs/{jobId}": {
      "get": {
        "summary": "Get a job by id.",
        "operationId": "getJob",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetJobResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "jobId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "SchedulerService"
        ],
        "x-udb-sdk-alias": "get_job",
        "x-udb-scope": [
          "udb:scheduler:get-job"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "scheduler",
        "x-udb-operation-kind": "read_only"
      },
      "delete": {
        "summary": "Delete (soft-delete) a job.",
        "operationId": "deleteJob",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteJobResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "jobId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "SchedulerService"
        ],
        "x-udb-sdk-alias": "delete_job",
        "x-udb-scope": [
          "udb:scheduler:delete-job"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "scheduler",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/scheduler/jobs/{jobId}:pause": {
      "post": {
        "summary": "Pause a job so the tick stops claiming it.",
        "operationId": "pauseJob",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PauseJobResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "jobId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/SchedulerServicePauseJobBody"
            }
          }
        ],
        "tags": [
          "SchedulerService"
        ],
        "x-udb-sdk-alias": "pause_job",
        "x-udb-scope": [
          "udb:scheduler:pause-job"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "scheduler",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/scheduler/jobs/{jobId}:resume": {
      "post": {
        "summary": "Resume a paused job.",
        "operationId": "resumeJob",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ResumeJobResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "jobId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/SchedulerServiceResumeJobBody"
            }
          }
        ],
        "tags": [
          "SchedulerService"
        ],
        "x-udb-sdk-alias": "resume_job",
        "x-udb-scope": [
          "udb:scheduler:resume-job"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "scheduler",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/search/indexes": {
      "get": {
        "summary": "List the calling tenant's registered indexes.",
        "operationId": "listSearchIndexes",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListIndexesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListIndexesResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "SearchService"
        ],
        "x-udb-sdk-alias": "list_indexes",
        "x-udb-scope": [
          "udb:search:list-indexes"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "search",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/search/indexes:create": {
      "post": {
        "summary": "Register a tenant-scoped index over a source entity. Fails closed\n(failed_precondition) when the source table has no resolvable tenant column.",
        "operationId": "createSearchIndex",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateIndexResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateIndexRequest"
            }
          }
        ],
        "tags": [
          "SearchService"
        ],
        "x-udb-sdk-alias": "create_index",
        "x-udb-scope": [
          "udb:search:create-index"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "search",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/search/indexes:delete": {
      "post": {
        "summary": "Delete a tenant-scoped index registration (destructive: drops the engine\nindex resource on the follow-up worker).",
        "operationId": "deleteSearchIndex",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteIndexResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteIndexRequest"
            }
          }
        ],
        "tags": [
          "SearchService"
        ],
        "x-udb-sdk-alias": "delete_index",
        "x-udb-scope": [
          "udb:search:delete-index"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "search",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/search/indexes:reindex": {
      "post": {
        "summary": "Request a full rebuild of an index from the source entity. The backfill\nreads source rows ONLY through the mediated IR path.",
        "operationId": "reindexSearchIndex",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ReindexResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ReindexRequest"
            }
          }
        ],
        "tags": [
          "SearchService"
        ],
        "x-udb-sdk-alias": "reindex",
        "x-udb-scope": [
          "udb:search:reindex"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "search",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/search:query": {
      "post": {
        "summary": "Run a full-text / vector / hybrid query. The tenant predicate is injected\nserver-side from the verified claim into every engine query.",
        "operationId": "search",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SearchResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SearchRequest"
            }
          }
        ],
        "tags": [
          "SearchService"
        ],
        "x-udb-sdk-alias": "search",
        "x-udb-scope": [
          "udb:search:search"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "search",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/storage/files": {
      "get": {
        "summary": "List files",
        "operationId": "listFiles",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListFilesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "fileType",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "referenceId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "referenceType",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "uploadedBy",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListFilesResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "StorageService"
        ],
        "x-udb-sdk-alias": "list_files",
        "x-udb-scope": [
          "udb:storage:list-files"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "storage",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/storage/files/{fileId}": {
      "get": {
        "summary": "Get file metadata",
        "operationId": "getFile",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetFileResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "fileId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "StorageService"
        ],
        "x-udb-sdk-alias": "get_file",
        "x-udb-scope": [
          "udb:storage:get-file"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "storage",
        "x-udb-operation-kind": "read_only"
      },
      "delete": {
        "summary": "Delete a file. `mode` selects soft-delete (default, metadata tombstone +\nbest-effort byte removal) or hard-delete (durable object-GC intent committed\natomically with the tombstone, then driven to convergence — a byte-delete\nfailure returns an error, never success, and leaves the intent for the sweep).",
        "operationId": "deleteFile",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteFileResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "fileId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "mode",
            "description": "Deletion mode. UNSPECIFIED/SOFT (default) soft-deletes the metadata and best-\neffort-removes the bytes. HARD durably records an object-GC intent atomically\nwith the tombstone and drives object deletion to convergence.\n\n - DELETE_MODE_UNSPECIFIED: treated as SOFT\n - DELETE_MODE_SOFT: metadata tombstone + best-effort byte removal\n - DELETE_MODE_HARD: durable object-GC intent + convergent byte removal",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "DELETE_MODE_UNSPECIFIED",
              "DELETE_MODE_SOFT",
              "DELETE_MODE_HARD"
            ],
            "default": "DELETE_MODE_UNSPECIFIED"
          },
          {
            "name": "reason",
            "description": "Optional operator-supplied reason, recorded on the durable GC intent (HARD).",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "expectedStatus",
            "description": "Optional optimistic-concurrency guard. When non-empty it is matched against\nthe file's current status token (PENDING/ACTIVE/DELETED) — the File row's\nrevision proxy (the entity carries no numeric version) — and a mismatch is\nrejected fail-closed so a stale client cannot delete a file that changed.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "idempotencyKey",
            "description": "Optional idempotency key (HARD). A replay with the SAME key + SAME target\nreturns the ORIGINAL recorded outcome; the SAME key with a DIFFERENT target\nconflicts fail-closed.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "StorageService"
        ],
        "x-udb-sdk-alias": "delete_file",
        "x-udb-scope": [
          "udb:storage:delete-file"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "storage",
        "x-udb-operation-kind": "mutation"
      },
      "patch": {
        "summary": "Update file metadata",
        "operationId": "updateFile",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateFileResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "fileId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/StorageServiceUpdateFileBody"
            }
          }
        ],
        "tags": [
          "StorageService"
        ],
        "x-udb-sdk-alias": "update_file",
        "x-udb-scope": [
          "udb:storage:update-file"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "storage",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/storage/files/{fileId}:download": {
      "get": {
        "summary": "Stream a file's bytes directly through the broker. FALLBACK for clients\nthat cannot use the presigned `GetDownloadUrl` HTTP GET (no egress to the\nobject store, corporate proxy, etc.). The broker streams the object bytes\nin bounded chunks server-side; it never buffers the whole object.",
        "operationId": "downloadFile",
        "responses": {
          "200": {
            "description": "A successful response.(streaming responses)",
            "schema": {
              "type": "object",
              "properties": {
                "result": {
                  "$ref": "#/definitions/v1DownloadFileChunk"
                },
                "error": {
                  "$ref": "#/definitions/rpcStatus"
                }
              },
              "title": "Stream result of v1DownloadFileChunk"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "fileId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "chunkSizeBytes",
            "description": "Optional preferred chunk size in bytes. Absent/0 → server default; the\nserver clamps to a safe bound so a client cannot force an unbounded frame.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          }
        ],
        "tags": [
          "StorageService"
        ],
        "x-udb-sdk-alias": "download_file",
        "x-udb-scope": [
          "udb:storage:get-download-url"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "storage",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/storage/files/{fileId}:getDownloadUrl": {
      "get": {
        "summary": "Get a pre-signed download URL for a file",
        "operationId": "getDownloadUrl",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetDownloadUrlResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "fileId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "expiresInMinutes",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          }
        ],
        "tags": [
          "StorageService"
        ],
        "x-udb-sdk-alias": "get_download_url",
        "x-udb-scope": [
          "udb:storage:get-download-url"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "storage",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/storage/files/{fileId}:reissueUploadUrl": {
      "get": {
        "summary": "Reissue a presigned PUT URL for an existing PENDING upload — the resume path\nwhen a RegisterUpload response was lost in flight (the client kept the file_id\nbut not the secret upload URL). The File row + object_key are unchanged; only\na fresh short-lived upload URL is minted. Rejected fail-closed for a\nnon-PENDING (already-finalized or removed) file. READ-ONLY (no state change).",
        "operationId": "reissueUploadUrl",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ReissueUploadUrlResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "fileId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "expiresInMinutes",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          }
        ],
        "tags": [
          "StorageService"
        ],
        "x-udb-sdk-alias": "reissue_upload_url",
        "x-udb-scope": [
          "udb:storage:reissue-upload-url"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "storage",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/storage/files/{fileId}:setScanVerdict": {
      "post": {
        "summary": "Record a content-scan verdict for a stored file (V050-3).",
        "description": "PRIVILEGED. `udb:storage:set-scan-verdict` is the scanner's scope and is\ndeliberately not bundled with any ordinary storage scope: a caller that can\nupload or read files must not be able to declare its own upload clean. The\nrecorded `scanned_by` is taken from the verified principal, never from the\nrequest body, so a verdict cannot be attributed to another scanner.",
        "operationId": "setScanVerdict",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SetScanVerdictResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "fileId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/StorageServiceSetScanVerdictBody"
            }
          }
        ],
        "tags": [
          "StorageService"
        ],
        "x-udb-sdk-alias": "set_scan_verdict",
        "x-udb-scope": [
          "udb:storage:set-scan-verdict"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "storage",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/storage/uploads": {
      "post": {
        "summary": "Register a new upload and obtain a pre-signed upload URL",
        "operationId": "registerUpload",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RegisterUploadResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RegisterUploadRequest"
            }
          }
        ],
        "tags": [
          "StorageService"
        ],
        "x-udb-sdk-alias": "register_upload",
        "x-udb-scope": [
          "udb:storage:register-upload"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "storage",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/storage/uploads/{fileId}:finalize": {
      "post": {
        "summary": "Finalize an upload after the object has been written to the store",
        "operationId": "finalizeUpload",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FinalizeUploadResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "fileId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/StorageServiceFinalizeUploadBody"
            }
          }
        ],
        "tags": [
          "StorageService"
        ],
        "x-udb-sdk-alias": "finalize_upload",
        "x-udb-scope": [
          "udb:storage:finalize-upload"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "storage",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/tenants": {
      "get": {
        "summary": "List tenants",
        "operationId": "listTenants",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListTenantsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "type",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "status",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListTenantsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "TenantService"
        ],
        "x-udb-sdk-alias": "list_tenants",
        "x-udb-scope": [
          "udb:tenant:list-tenants"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "tenants",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "Create tenant",
        "operationId": "createTenant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateTenantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateTenantRequest"
            }
          }
        ],
        "tags": [
          "TenantService"
        ],
        "x-udb-sdk-alias": "create_tenant",
        "x-udb-scope": [
          "udb:tenant:create-tenant"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "tenants",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/tenants/{targetTenantId}:adminPurge": {
      "post": {
        "summary": "PRIVILEGED cross-tenant purge (Bug #2). Unlike PurgeTenant — which forces the\nbody tenant to equal the verified claim (self-purge only) — this RPC lets a\ndelegated operator purge a DIFFERENT `target_tenant_id`. It is gated by a\nDISTINCT, default-deny scope (`udb:tenant:admin-purge`) SEPARATE from the\nself-purge scope, is DESTRUCTIVE, and demands an explicit confirmation token\nplus an idempotency key. The handler routes the movement with\n`privileged_cross_tenant=true`, binds the VERIFIED delegated actor, treats\ncontrol-plane / tenant-less tables explicitly (retained + reported, never\nblind-deleted), and writes an immutable audit/outcome record. `tenant_field`\nnames the body tenant the action targets (`target_tenant_id`); the handler —\nnot the transport gate — authorizes the cross-tenant reach via the scope.",
        "operationId": "adminPurgeTenant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AdminPurgeTenantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "targetTenantId",
            "description": "The tenant to purge — MAY differ from the caller's own tenant (this is the\nprivileged cross-tenant path; the self-purge PurgeTenant forbids that).",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/TenantServiceAdminPurgeTenantBody"
            }
          }
        ],
        "tags": [
          "TenantService"
        ],
        "x-udb-sdk-alias": "admin_purge_tenant",
        "x-udb-scope": [
          "udb:tenant:admin-purge"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "tenants",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/tenants/{tenantId}": {
      "get": {
        "summary": "Get tenant",
        "operationId": "getTenant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetTenantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ],
        "tags": [
          "TenantService"
        ],
        "x-udb-sdk-alias": "get_tenant",
        "x-udb-scope": [
          "udb:tenant:get-tenant"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "tenants",
        "x-udb-operation-kind": "read_only"
      },
      "patch": {
        "summary": "Update tenant",
        "operationId": "updateTenant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateTenantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/TenantServiceUpdateTenantBody"
            }
          }
        ],
        "tags": [
          "TenantService"
        ],
        "x-udb-sdk-alias": "update_tenant",
        "x-udb-scope": [
          "udb:tenant:update-tenant"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "tenants",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/tenants/{tenantId}/config": {
      "get": {
        "summary": "Get tenant config",
        "operationId": "getTenantConfig",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetTenantConfigResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ],
        "tags": [
          "TenantService"
        ],
        "x-udb-sdk-alias": "get_tenant_config",
        "x-udb-scope": [
          "udb:tenant:get-tenant-config"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "tenants",
        "x-udb-operation-kind": "read_only"
      },
      "put": {
        "summary": "Update tenant config",
        "operationId": "updateTenantConfig",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateTenantConfigResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/TenantServiceUpdateTenantConfigBody"
            }
          }
        ],
        "tags": [
          "TenantService"
        ],
        "x-udb-sdk-alias": "update_tenant_config",
        "x-udb-scope": [
          "udb:tenant:update-tenant-config"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "tenants",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/tenants/{tenantId}:purge": {
      "post": {
        "summary": "Purge tenant (GDPR right-to-be-forgotten). HARD-deletes every row the tenant\nowns across all tenant-columned entity tables, then revokes the tenant's and\nits principals' tokens. Irreversible — DESTRUCTIVE op-kind + a required\nconfirmation token gate it. Mirrors the destructive-RPC endpoint_security of\nsiblings like authn.ChangeUserStatus (AUTH_MODE_BEARER, tenant_required,\nrequest_context_required).",
        "operationId": "purgeTenant",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PurgeTenantResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/TenantServicePurgeTenantBody"
            }
          }
        ],
        "tags": [
          "TenantService"
        ],
        "x-udb-sdk-alias": "purge_tenant",
        "x-udb-scope": [
          "udb:tenant:purge-tenant"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "tenants",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/vault/database/credentials": {
      "post": {
        "summary": "Mint short-lived, per-request Postgres credentials with a durable lease.\nThe requested role_name is an operator-configured alias resolved from\nUDB_VAULT_DB_ROLES_JSON; arbitrary request-supplied role grants fail closed.\nThe authenticated tenant/project/caller and idempotency_key are durably\ndeduplicated in the same transaction that activates the issued lease.\nWORKER_VAULT_LEASE_REAPER revokes and drops expired generated login roles.",
        "operationId": "generateDatabaseCredentials",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GenerateDatabaseCredentialsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1GenerateDatabaseCredentialsRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "generate_database_credentials",
        "x-udb-scope": [
          "udb:vault:generate-db-credentials"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "idempotency_key",
          "server_generated_key": false,
          "duplicate_response_field": "replayed",
          "replay_safe": true
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/database/credentials/{leaseId}:revoke": {
      "post": {
        "summary": "Revoke one lease in the authenticated tenant/project. The durable state is\nmoved to REVOKING before physical session fencing and becomes REVOKED only\nafter the generated role is proven absent. The tenant/project/caller and\nlease_id dedup record transition in one transaction, so replay is safe.",
        "operationId": "revokeDatabaseCredentials",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RevokeDatabaseCredentialsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "leaseId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/VaultServiceRevokeDatabaseCredentialsBody"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "revoke_database_credentials",
        "x-udb-scope": [
          "udb:vault:revoke-db-credentials"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "lease_id",
          "server_generated_key": false,
          "duplicate_response_field": "replayed",
          "replay_safe": true
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/vault/database/credentials:emergencyRevoke": {
      "post": {
        "summary": "Emergency kill-switch for every non-terminal lease in exactly one verified\ntenant/project. A confirmation token bound to both scope dimensions prevents\nan accidental tenant-wide or cross-project credential wipe.",
        "operationId": "emergencyRevokeDatabaseCredentials",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1EmergencyRevokeDatabaseCredentialsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1EmergencyRevokeDatabaseCredentialsRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "emergency_revoke_database_credentials",
        "x-udb-scope": [
          "udb:vault:emergency-revoke-db-credentials"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/vault/seal-status": {
      "get": {
        "summary": "Report whether the vault is sealed (master key unavailable). Always answers,\neven when sealed, so operators can diagnose a sealed vault.",
        "operationId": "vaultSealStatus",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SealStatusResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "seal_status",
        "x-udb-scope": [
          "udb:vault:seal-status"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/vault/secrets": {
      "get": {
        "summary": "List secret paths under an optional prefix. Returns metadata only — NEVER\nany secret value.",
        "operationId": "listSecrets",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListSecretsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pathPrefix",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListSecretsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "list_secrets",
        "x-udb-scope": [
          "udb:vault:list-secrets"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/vault/secrets/{secretPath}": {
      "get": {
        "summary": "Read the secret value (latest active version, or a specific version). This\nis the sensitive vault read: it is AUDITED via the outbox compliance envelope.",
        "operationId": "getSecret",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetSecretResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "secretPath",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": ".+"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "version",
            "description": "0 ⇒ latest active version; otherwise the specific version.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "get_secret",
        "x-udb-scope": [
          "udb:vault:get-secret"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/vault/secrets:delete": {
      "post": {
        "summary": "Soft-delete the latest version (recoverable bookkeeping state). The ciphertext\nis retained; use DestroySecret to crypto-shred.",
        "operationId": "deleteSecret",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteSecretResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteSecretRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "delete_secret",
        "x-udb-scope": [
          "udb:vault:delete-secret"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/secrets:destroy": {
      "post": {
        "summary": "Crypto-shred every version of a secret: clears the wrapped DEK + ciphertext\nso the value is irrecoverable. DESTRUCTIVE + irreversible — a confirmation\ntoken is required and an empty token fails closed.",
        "operationId": "destroySecret",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DestroySecretResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DestroySecretRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "destroy_secret",
        "x-udb-scope": [
          "udb:vault:destroy-secret"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/vault/secrets:put": {
      "post": {
        "summary": "Write a new secret version. Compare-and-swap: `expected_version` must equal\nthe current latest version (0 for a brand-new path) or the write is rejected.",
        "operationId": "putSecret",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PutSecretResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1PutSecretRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "put_secret",
        "x-udb-scope": [
          "udb:vault:put-secret"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/secrets:undelete": {
      "post": {
        "summary": "Restore a soft-DELETED secret: flip its latest deleted version back to ACTIVE.\nA soft delete keeps the ciphertext + wrapped key, so recovery is exact. A\ncrypto-shredded (DestroySecret) version can NEVER be restored.",
        "operationId": "undeleteSecret",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UndeleteSecretResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1UndeleteSecretRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "undelete_secret",
        "x-udb-scope": [
          "udb:vault:undelete-secret"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/transit/keys": {
      "post": {
        "summary": "Create a named transit key (version 1, ACTIVE). Key material is generated\nserver-side and never returned.",
        "operationId": "createTransitKey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateTransitKeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateTransitKeyRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "create_transit_key",
        "x-udb-scope": [
          "udb:vault:create-transit-key"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/transit/keys:rotate": {
      "post": {
        "summary": "Rotate a named transit key: the current ACTIVE version is demoted to\nVERIFYING (still decrypts/verifies during the overlap) and a fresh ACTIVE\nversion is generated. New encryptions/signatures use the new version.",
        "operationId": "rotateTransitKey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RotateTransitKeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RotateTransitKeyRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "rotate_transit_key",
        "x-udb-scope": [
          "udb:vault:rotate-transit-key"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/transit:batchDecrypt": {
      "post": {
        "summary": "Decrypt MANY transit ciphertexts under one key in a single call; each\nciphertext carries its own key version in the envelope. Order-preserving.",
        "operationId": "vaultBatchDecrypt",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1BatchDecryptResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1BatchDecryptRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "batch_decrypt",
        "x-udb-scope": [
          "udb:vault:decrypt"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/transit:batchEncrypt": {
      "post": {
        "summary": "Encrypt MANY plaintexts under one transit key in a single call: the key is\nunwrapped ONCE and each plaintext sealed with the active version, amortizing\nthe master-key unwrap over the batch. Order-preserving. AUDITED.",
        "operationId": "vaultBatchEncrypt",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1BatchEncryptResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1BatchEncryptRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "batch_encrypt",
        "x-udb-scope": [
          "udb:vault:encrypt"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/transit:decrypt": {
      "post": {
        "summary": "Decrypt a transit ciphertext envelope. The version is read from the envelope\nand ACTIVE or VERIFYING versions are accepted. This is a sensitive read and is\nAUDITED via the outbox compliance envelope.",
        "operationId": "vaultDecrypt",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DecryptResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DecryptRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "decrypt",
        "x-udb-scope": [
          "udb:vault:decrypt"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/vault/transit:encrypt": {
      "post": {
        "summary": "Encrypt plaintext under the ACTIVE version of a named key. Returns a\nversioned ciphertext envelope; the key material is never returned.",
        "operationId": "vaultEncrypt",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1EncryptResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1EncryptRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "encrypt",
        "x-udb-scope": [
          "udb:vault:encrypt"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/transit:generateDataKey": {
      "post": {
        "summary": "Generate a fresh 256-bit data key, returned BOTH plaintext (for the caller to\nencrypt data locally) AND wrapped under the named transit key (store this and\nDecrypt/Rewrap it later). Envelope-encryption without exposing the transit\nkey. Reuses the transit seal path; AUDITED via the outbox compliance envelope.",
        "operationId": "vaultGenerateDataKey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GenerateDataKeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1GenerateDataKeyRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "generate_data_key",
        "x-udb-scope": [
          "udb:vault:generate-data-key"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/transit:hmac": {
      "post": {
        "summary": "Compute an HMAC-SHA256 over the input under the ACTIVE key version. Key\nmaterial is never returned.",
        "operationId": "vaultHmac",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1HmacResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1HmacRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "hmac",
        "x-udb-scope": [
          "udb:vault:hmac"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/transit:publicKey": {
      "post": {
        "summary": "Export the Ed25519 PUBLIC key(s) of a signing transit key so an external\nparty can verify broker-produced signatures without ever holding the private\nkey — the missing half that makes Sign/Verify genuinely asymmetric. Only\nvalid for keys created with the ed25519 algorithm; READ-ONLY (public keys are\nnot secret). Returns one entry per usable (ACTIVE/VERIFYING) version.",
        "operationId": "vaultGetTransitPublicKey",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetTransitPublicKeyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1GetTransitPublicKeyRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "get_transit_public_key",
        "x-udb-scope": [
          "udb:vault:get-public-key"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/vault/transit:rewrap": {
      "post": {
        "summary": "Re-wrap a transit ciphertext under the key's CURRENT active version: decrypt\nwith the version embedded in the envelope, then re-seal with the active\nversion. The post-rotation migration primitive (no plaintext leaves the\nbroker). AUDITED via the outbox compliance envelope.",
        "operationId": "vaultRewrap",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RewrapResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RewrapRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "rewrap",
        "x-udb-scope": [
          "udb:vault:rewrap"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/transit:sign": {
      "post": {
        "summary": "Produce a detached MAC (\"signature\") over the input under the ACTIVE key\nversion. Implemented as HMAC-SHA256 from the version DEK (symmetric);\nasymmetric signing is a follow-up. Key material is never returned.",
        "operationId": "vaultSign",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SignResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SignRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "sign",
        "x-udb-scope": [
          "udb:vault:sign"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/vault/transit:verify": {
      "post": {
        "summary": "Verify a MAC/signature over the input. The version is read from the\nsignature and ACTIVE or VERIFYING versions are accepted; comparison is\nconstant-time.",
        "operationId": "vaultVerify",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1VerifyResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1VerifyRequest"
            }
          }
        ],
        "tags": [
          "VaultService"
        ],
        "x-udb-sdk-alias": "verify",
        "x-udb-scope": [
          "udb:vault:verify"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "vault",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/webhook/deliveries": {
      "get": {
        "summary": "List the delivery journal for a tenant, optionally narrowed to one endpoint\nor one delivery status.",
        "operationId": "listWebhookDeliveries",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListDeliveriesResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "endpointId",
            "description": "optional filter",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "status",
            "description": "optional filter",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListDeliveriesResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "WebhookService"
        ],
        "x-udb-sdk-alias": "list_deliveries",
        "x-udb-scope": [
          "udb:webhook:list-deliveries"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webhook",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/webhook/endpoints": {
      "get": {
        "summary": "List a tenant's webhook endpoints (signing secrets are NEVER returned).",
        "operationId": "listWebhookEndpoints",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListEndpointsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "activeOnly",
            "in": "query",
            "required": false,
            "type": "boolean"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListEndpointsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "WebhookService"
        ],
        "x-udb-sdk-alias": "list_endpoints",
        "x-udb-scope": [
          "udb:webhook:list-endpoints"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webhook",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "Register an external webhook endpoint. The target URL is SSRF-validated\n(https-only, no private/loopback/link-local/CGNAT host). The per-endpoint\nsigning secret is returned exactly once in the response and never again.",
        "operationId": "createWebhookEndpoint",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateEndpointResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateEndpointRequest"
            }
          }
        ],
        "tags": [
          "WebhookService"
        ],
        "x-udb-sdk-alias": "create_endpoint",
        "x-udb-scope": [
          "udb:webhook:create-endpoint"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webhook",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webhook/endpoints/{endpointId}": {
      "get": {
        "summary": "Fetch one webhook endpoint (the signing secret is NEVER returned on read).",
        "operationId": "getWebhookEndpoint",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetEndpointResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "endpointId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "WebhookService"
        ],
        "x-udb-sdk-alias": "get_endpoint",
        "x-udb-scope": [
          "udb:webhook:get-endpoint"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webhook",
        "x-udb-operation-kind": "read_only"
      },
      "delete": {
        "summary": "Delete (soft) a webhook endpoint; no further events are delivered to it.",
        "operationId": "deleteWebhookEndpoint",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteEndpointResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "endpointId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "WebhookService"
        ],
        "x-udb-sdk-alias": "delete_endpoint",
        "x-udb-scope": [
          "udb:webhook:delete-endpoint"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webhook",
        "x-udb-operation-kind": "destructive"
      },
      "patch": {
        "summary": "Update an endpoint. A changed URL is SSRF-revalidated before it is stored.",
        "operationId": "updateWebhookEndpoint",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateEndpointResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "endpointId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/WebhookServiceUpdateEndpointBody"
            }
          }
        ],
        "tags": [
          "WebhookService"
        ],
        "x-udb-sdk-alias": "update_endpoint",
        "x-udb-scope": [
          "udb:webhook:update-endpoint"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webhook",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/egress": {
      "get": {
        "summary": "List egress jobs for the verified tenant.",
        "operationId": "listEgress",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListEgressResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "roomId",
            "description": "Optional room filter; empty = all rooms for the tenant.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "status",
            "description": "Optional status filter.\n\n - EGRESS_STATUS_STARTING: Accepted; the backend is bringing the egress up.\n - EGRESS_STATUS_ACTIVE: Egress is running and producing output.\n - EGRESS_STATUS_STOPPING: Stop requested; the backend is tearing the egress down.\n - EGRESS_STATUS_STOPPED: Egress has stopped cleanly (terminal).\n - EGRESS_STATUS_FAILED: Egress failed to start or aborted (terminal).",
            "in": "query",
            "required": false,
            "type": "string",
            "enum": [
              "EGRESS_STATUS_UNSPECIFIED",
              "EGRESS_STATUS_STARTING",
              "EGRESS_STATUS_ACTIVE",
              "EGRESS_STATUS_STOPPING",
              "EGRESS_STATUS_STOPPED",
              "EGRESS_STATUS_FAILED"
            ],
            "default": "EGRESS_STATUS_UNSPECIFIED"
          },
          {
            "name": "pageSize",
            "description": "Requested page size. Defaults to 50 and is capped at the native list maximum.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListEgressResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "RoomService"
        ],
        "x-udb-sdk-alias": "list_egress",
        "x-udb-scope": [
          "udb:webrtc:room:list-egress"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/webrtc/egress/{egressId}:stop": {
      "post": {
        "summary": "Stop a running egress. `egress_id` must belong to the verified tenant.",
        "operationId": "stopEgress",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1StopEgressResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "egressId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/RoomServiceStopEgressBody"
            }
          }
        ],
        "tags": [
          "RoomService"
        ],
        "x-udb-sdk-alias": "stop_egress",
        "x-udb-scope": [
          "udb:webrtc:room:stop-egress"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/peers/{peerId}": {
      "get": {
        "summary": "Get a peer",
        "operationId": "getPeer",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetPeerResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "peerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "PeerService"
        ],
        "x-udb-sdk-alias": "get_peer",
        "x-udb-scope": [
          "udb:webrtc:peer:get-peer"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/webrtc/rooms": {
      "get": {
        "summary": "List rooms",
        "operationId": "listRooms",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListRoomsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "state",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListRoomsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "RoomService"
        ],
        "x-udb-sdk-alias": "list_rooms",
        "x-udb-scope": [
          "udb:webrtc:room:list-rooms"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "Create a room",
        "operationId": "createRoom",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateRoomResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateRoomRequest"
            }
          }
        ],
        "tags": [
          "RoomService"
        ],
        "x-udb-sdk-alias": "create_room",
        "x-udb-scope": [
          "udb:webrtc:room:create-room"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/rooms/{roomId}": {
      "get": {
        "summary": "Get a room",
        "operationId": "getRoom",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetRoomResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roomId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "RoomService"
        ],
        "x-udb-sdk-alias": "get_room",
        "x-udb-scope": [
          "udb:webrtc:room:get-room"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "read_only"
      },
      "patch": {
        "summary": "Update a room",
        "operationId": "updateRoom",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateRoomResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roomId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/RoomServiceUpdateRoomBody"
            }
          }
        ],
        "tags": [
          "RoomService"
        ],
        "x-udb-sdk-alias": "update_room",
        "x-udb-scope": [
          "udb:webrtc:room:update-room"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/rooms/{roomId}/egress:composite": {
      "post": {
        "summary": "Start a composite recording/egress of a whole room.",
        "operationId": "startRoomComposite",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1StartRoomCompositeResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roomId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/RoomServiceStartRoomCompositeBody"
            }
          }
        ],
        "tags": [
          "RoomService"
        ],
        "x-udb-sdk-alias": "start_room_composite",
        "x-udb-scope": [
          "udb:webrtc:room:start-room-composite"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/rooms/{roomId}/peers": {
      "get": {
        "summary": "List peers",
        "operationId": "listPeers",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListPeersResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roomId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "state",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "description": "Requested page size. Defaults to 50 and is capped at the native list maximum.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListPeersResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "PeerService"
        ],
        "x-udb-sdk-alias": "list_peers",
        "x-udb-scope": [
          "udb:webrtc:peer:list-peers"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "read_only"
      },
      "post": {
        "summary": "Join a room",
        "operationId": "joinRoom",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1JoinRoomResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roomId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/PeerServiceJoinRoomBody"
            }
          }
        ],
        "tags": [
          "PeerService"
        ],
        "x-udb-sdk-alias": "join_room",
        "x-udb-scope": [
          "udb:webrtc:peer:join-room"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/rooms/{roomId}/peers/{peerId}:leave": {
      "post": {
        "summary": "Leave a room",
        "operationId": "leaveRoom",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1LeaveRoomResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roomId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "peerId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/PeerServiceLeaveRoomBody"
            }
          }
        ],
        "tags": [
          "PeerService"
        ],
        "x-udb-sdk-alias": "leave_room",
        "x-udb-scope": [
          "udb:webrtc:peer:leave-room"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/rooms/{roomId}/tracks": {
      "get": {
        "summary": "List tracks",
        "operationId": "listTracks",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListTracksResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roomId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "peerId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "kind",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "pageSize",
            "description": "Requested page size. Defaults to 50 and is capped at the native list maximum.",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListTracksResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "TrackService"
        ],
        "x-udb-sdk-alias": "list_tracks",
        "x-udb-scope": [
          "udb:webrtc:track:list-tracks"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/webrtc/rooms/{roomId}:close": {
      "post": {
        "summary": "Close a room",
        "operationId": "closeRoom",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CloseRoomResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "roomId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/RoomServiceCloseRoomBody"
            }
          }
        ],
        "tags": [
          "RoomService"
        ],
        "x-udb-sdk-alias": "close_room",
        "x-udb-scope": [
          "udb:webrtc:room:close-room"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/tracks": {
      "post": {
        "summary": "Publish a track",
        "operationId": "publishTrack",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1PublishTrackResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1PublishTrackRequest"
            }
          }
        ],
        "tags": [
          "TrackService"
        ],
        "x-udb-sdk-alias": "publish_track",
        "x-udb-scope": [
          "udb:webrtc:track:publish-track"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/tracks/{trackId}:mute": {
      "post": {
        "summary": "Mute or unmute a track",
        "operationId": "muteTrack",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1MuteTrackResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "trackId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/TrackServiceMuteTrackBody"
            }
          }
        ],
        "tags": [
          "TrackService"
        ],
        "x-udb-sdk-alias": "mute_track",
        "x-udb-scope": [
          "udb:webrtc:track:mute-track"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/tracks/{trackId}:startEgress": {
      "post": {
        "summary": "Start an egress of a single published track.",
        "operationId": "startTrackEgress",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1StartTrackEgressResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "trackId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/RoomServiceStartTrackEgressBody"
            }
          }
        ],
        "tags": [
          "RoomService"
        ],
        "x-udb-sdk-alias": "start_track_egress",
        "x-udb-scope": [
          "udb:webrtc:room:start-track-egress"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/tracks/{trackId}:unpublish": {
      "post": {
        "summary": "Unpublish a track",
        "operationId": "unpublishTrack",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UnpublishTrackResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "trackId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/TrackServiceUnpublishTrackBody"
            }
          }
        ],
        "tags": [
          "TrackService"
        ],
        "x-udb-sdk-alias": "unpublish_track",
        "x-udb-scope": [
          "udb:webrtc:track:unpublish-track"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/webrtc/turn/credentials": {
      "post": {
        "summary": "Issue ephemeral TURN/STUN credentials",
        "operationId": "issueCredentials",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1IssueCredentialsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1IssueCredentialsRequest"
            }
          }
        ],
        "tags": [
          "TurnService"
        ],
        "x-udb-sdk-alias": "issue_credentials",
        "x-udb-scope": [
          "udb:webrtc:turn:issue-credentials"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "webrtc",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/workflows": {
      "get": {
        "summary": "List workflow instances for the verified tenant, optionally filtered by status.",
        "operationId": "listWorkflows",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListWorkflowsResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "status",
            "description": "Optional status filter (e.g. \"RUNNING\"); empty returns all non-deleted rows.",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "page",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageSize",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32"
          },
          {
            "name": "pageToken",
            "description": "Opaque pagination token returned by ListWorkflowsResponse.next_page_token.",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "WorkflowService"
        ],
        "x-udb-sdk-alias": "list_workflows",
        "x-udb-scope": [
          "udb:workflow:list-workflows"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "workflows",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/workflows/{workflowId}": {
      "get": {
        "summary": "Fetch a single workflow instance by id (tenant-scoped).",
        "operationId": "getWorkflow",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetWorkflowResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "workflowId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "tenantId",
            "in": "query",
            "required": false,
            "type": "string"
          }
        ],
        "tags": [
          "WorkflowService"
        ],
        "x-udb-sdk-alias": "get_workflow",
        "x-udb-scope": [
          "udb:workflow:get-workflow"
        ],
        "x-udb-retry-safe": true,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "workflows",
        "x-udb-operation-kind": "read_only"
      }
    },
    "/v1/workflows/{workflowId}:cancel": {
      "post": {
        "summary": "Cancel a workflow and trigger the saga compensation path (reverse-order). The\ninstance moves to COMPENSATING and the EXISTING recovery worker undoes the\nrecorded side effects — this RPC never reimplements compensation.",
        "operationId": "cancelWorkflow",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CancelWorkflowResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "workflowId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/WorkflowServiceCancelWorkflowBody"
            }
          }
        ],
        "tags": [
          "WorkflowService"
        ],
        "x-udb-sdk-alias": "cancel_workflow",
        "x-udb-scope": [
          "udb:workflow:cancel-workflow"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "workflows",
        "x-udb-operation-kind": "destructive"
      }
    },
    "/v1/workflows/{workflowId}:signal": {
      "post": {
        "summary": "Deliver an external signal to a waiting workflow step, resuming forward\nprogress (the durable equivalent of completing a blocked step).",
        "operationId": "signalWorkflow",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1SignalWorkflowResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "workflowId",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/WorkflowServiceSignalWorkflowBody"
            }
          }
        ],
        "tags": [
          "WorkflowService"
        ],
        "x-udb-sdk-alias": "signal_workflow",
        "x-udb-scope": [
          "udb:workflow:signal-workflow"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "workflows",
        "x-udb-operation-kind": "mutation"
      }
    },
    "/v1/workflows:start": {
      "post": {
        "summary": "Start a durable workflow instance and hand it to the saga engine. The instance\nis persisted before any forward step runs, so it survives a restart.",
        "operationId": "startWorkflow",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1StartWorkflowResponse"
            }
          },
          "400": {
            "description": "gRPC INVALID_ARGUMENT/FAILED_PRECONDITION mapped to HTTP 400. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "INVALID_ARGUMENT",
              "FAILED_PRECONDITION"
            ]
          },
          "401": {
            "description": "gRPC UNAUTHENTICATED mapped to HTTP 401. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAUTHENTICATED"
            ]
          },
          "403": {
            "description": "gRPC PERMISSION_DENIED mapped to HTTP 403. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "PERMISSION_DENIED"
            ]
          },
          "404": {
            "description": "gRPC NOT_FOUND mapped to HTTP 404. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "NOT_FOUND"
            ]
          },
          "409": {
            "description": "gRPC ALREADY_EXISTS/ABORTED mapped to HTTP 409. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "ALREADY_EXISTS",
              "ABORTED"
            ]
          },
          "429": {
            "description": "gRPC RESOURCE_EXHAUSTED mapped to HTTP 429. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "RESOURCE_EXHAUSTED"
            ]
          },
          "500": {
            "description": "gRPC UNKNOWN/INTERNAL/DATA_LOSS mapped to HTTP 500. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN",
              "INTERNAL",
              "DATA_LOSS"
            ]
          },
          "501": {
            "description": "gRPC UNIMPLEMENTED mapped to HTTP 501. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNIMPLEMENTED"
            ]
          },
          "503": {
            "description": "gRPC UNAVAILABLE mapped to HTTP 503. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNAVAILABLE"
            ]
          },
          "504": {
            "description": "gRPC DEADLINE_EXCEEDED mapped to HTTP 504. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "DEADLINE_EXCEEDED"
            ]
          },
          "default": {
            "description": "Unexpected gRPC error response. Body preserves the canonical gRPC code/message and UDB ErrorDetail-derived fields.",
            "schema": {
              "$ref": "#/definitions/v1ApiError"
            },
            "x-udb-grpc-codes": [
              "UNKNOWN"
            ]
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1StartWorkflowRequest"
            }
          }
        ],
        "tags": [
          "WorkflowService"
        ],
        "x-udb-sdk-alias": "start_workflow",
        "x-udb-scope": [
          "udb:workflow:start-workflow"
        ],
        "x-udb-retry-safe": false,
        "x-udb-idempotency": {
          "request_key_field": "",
          "server_generated_key": false,
          "duplicate_response_field": "",
          "replay_safe": false
        },
        "x-udb-resource": "workflows",
        "x-udb-operation-kind": "mutation"
      }
    }
  },
  "definitions": {
    "ApiKeyServiceRotateApiKeyBody": {
      "type": "object",
      "properties": {
        "rotationReason": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      },
      "description": "Rotate a key: mint a fresh secret under the same key record + lineage, return\nthe new plain key ONCE, and invalidate the old secret. The rotated key keeps\nthe same key_id, owner, scopes, tenant, and project (rotation lineage)."
    },
    "ApiKeyServiceUpdateApiKeyBody": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "ipAllowlist": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "rateLimitPerMinute": {
          "type": "integer",
          "format": "int32"
        },
        "rateLimitPerDay": {
          "type": "string",
          "format": "int64"
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        },
        "updateMask": {
          "type": "string",
          "description": "Optional PATCH mask relative to the API key resource. When omitted, legacy\nclients keep the historical non-empty-field patch behavior."
        }
      },
      "title": "Update mutable fields: name, description, scopes, ip_allowlist, rate limits, expires_at"
    },
    "AssetServiceCompleteStepBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "status": {
          "type": "string",
          "title": "COMPLETED | SKIPPED | FAILED"
        },
        "result": {
          "type": "string",
          "title": "JSON"
        },
        "errorMessage": {
          "type": "string"
        }
      }
    },
    "AuthnServiceAdminResetMfaBody": {
      "type": "object",
      "properties": {
        "reason": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceAdminResetPasswordBody": {
      "type": "object",
      "properties": {
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      },
      "title": "Admin password reset (generates a temporary password + sends email OTP)"
    },
    "AuthnServiceAdminRevokeAllTenantSessionsBody": {
      "type": "object",
      "properties": {
        "reason": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceAdminRevokeAllUserSessionsBody": {
      "type": "object",
      "properties": {
        "reason": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceAdminRevokeSessionBody": {
      "type": "object",
      "properties": {
        "sessionId": {
          "type": "string",
          "title": "public session handle"
        },
        "reason": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceChangeUserStatusBody": {
      "type": "object",
      "properties": {
        "newStatus": {
          "$ref": "#/definitions/v1UserStatus"
        },
        "reason": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceConfirmMFAEnrollmentBody": {
      "type": "object",
      "properties": {
        "otpId": {
          "type": "string"
        },
        "code": {
          "type": "string",
          "title": "TOTP code or email OTP code to confirm"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceCreateServiceAccountGrantBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "serviceIdentity": {
          "type": "string",
          "description": "The IMMUTABLE service identity (e.g. a SPIFFE URI or stable service name)."
        },
        "projectId": {
          "type": "string"
        },
        "approvedScopes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Operator-approved scopes; admin/owner/wildcard scopes are rejected."
        },
        "reason": {
          "type": "string"
        }
      }
    },
    "AuthnServiceDisableMfaFactorBody": {
      "type": "object",
      "properties": {
        "factorKind": {
          "$ref": "#/definitions/v1AuthFactorKind"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceEnrollMFABody": {
      "type": "object",
      "properties": {
        "mfaType": {
          "$ref": "#/definitions/v1AuthFactorKind"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceGenerateRecoveryCodesBody": {
      "type": "object",
      "properties": {
        "count": {
          "type": "integer",
          "format": "int32",
          "title": "number of codes to generate (server clamps to a sane range; default 10)"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServicePutMfaPolicyBody": {
      "type": "object",
      "properties": {
        "requireMfa": {
          "type": "boolean"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceRefreshSessionBody": {
      "type": "object",
      "properties": {
        "ttlSeconds": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "AuthnServiceRenamePasskeyBody": {
      "type": "object",
      "properties": {
        "credentialId": {
          "type": "string"
        },
        "newLabel": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceReplaceServiceAccountGrantBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "approvedScopes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Operator-approved scopes; admin/owner/wildcard scopes are rejected."
        },
        "projectId": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        },
        "expectedRevision": {
          "type": "string",
          "format": "int64",
          "description": "The current grant revision this replace was reviewed against; mismatch\nfails with FAILED_PRECONDITION."
        }
      }
    },
    "AuthnServiceRevokeCertificateBindingBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        }
      }
    },
    "AuthnServiceRevokeRecoveryCodesBody": {
      "type": "object",
      "properties": {
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceRevokeServiceAccountGrantBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        }
      }
    },
    "AuthnServiceRotateServiceAccountIdentityBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "newServiceIdentity": {
          "type": "string"
        },
        "expectedRevision": {
          "type": "string",
          "format": "int64"
        },
        "reason": {
          "type": "string"
        }
      }
    },
    "AuthnServiceSendPhoneVerificationBody": {
      "type": "object",
      "properties": {
        "phone": {
          "type": "string",
          "title": "E.164 number to set + verify"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceStartWebAuthnRegistrationBody": {
      "type": "object",
      "properties": {
        "label": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "AuthnServiceTransferServiceAccountGrantBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "toUserId": {
          "type": "string",
          "description": "The service account to transfer the grant/identity to. Must be an ACTIVE\nservice account in the same tenant/project with no existing grant."
        },
        "expectedRevision": {
          "type": "string",
          "format": "int64",
          "description": "Optimistic-concurrency guard: the source grant's current revision."
        },
        "reason": {
          "type": "string"
        }
      }
    },
    "AuthnServiceUpdateUserBody": {
      "type": "object",
      "properties": {
        "fullName": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        },
        "accountKind": {
          "$ref": "#/definitions/v1AccountKind"
        },
        "projectId": {
          "type": "string"
        },
        "profileAttributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "externalProviderId": {
          "type": "string"
        },
        "externalSubject": {
          "type": "string"
        },
        "updateMask": {
          "type": "string",
          "description": "Optional PATCH mask relative to the user resource. When omitted, legacy\nclients keep the historical non-empty-field patch behavior."
        }
      }
    },
    "AuthzServiceAssignRoleBody": {
      "type": "object",
      "properties": {
        "roleId": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        },
        "assignedBy": {
          "type": "string"
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time"
        },
        "principalId": {
          "type": "string"
        },
        "principalKind": {
          "$ref": "#/definitions/v1PrincipalKind"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        }
      },
      "required": [
        "roleId",
        "domain",
        "assignedBy"
      ]
    },
    "AuthzServiceRevokeRoleBody": {
      "type": "object",
      "properties": {
        "reason": {
          "type": "string"
        },
        "revokedBy": {
          "type": "string"
        }
      }
    },
    "AuthzServiceUpdateRoleBody": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "isActive": {
          "type": "boolean"
        },
        "updatedBy": {
          "type": "string"
        },
        "updateMask": {
          "type": "string",
          "description": "Optional PATCH mask relative to the role resource. When omitted, legacy\nclients keep the historical non-empty-field patch behavior."
        }
      },
      "required": [
        "updatedBy"
      ]
    },
    "CacheServiceDeleteNamespaceBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "confirmationToken": {
          "type": "string",
          "description": "Required explicit confirmation token; an empty token fails closed\n(DESTRUCTIVE namespace flush)."
        }
      }
    },
    "CacheServiceSetBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "value": {
          "type": "string",
          "format": "byte"
        },
        "ttlSeconds": {
          "type": "string",
          "format": "int64",
          "description": "0 = use the namespace default TTL (or no expiry if none configured)."
        }
      }
    },
    "ControlPlaneServiceAckStatusBody": {
      "type": "object",
      "properties": {
        "resourceType": {
          "$ref": "#/definitions/v1ResourceType"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "ControlPlaneServiceRollbackResourcesBody": {
      "type": "object",
      "properties": {
        "resourceType": {
          "$ref": "#/definitions/v1ResourceType"
        },
        "targetVersion": {
          "type": "string",
          "description": "Optional explicit retained version to roll back to. Empty == the most recent\nretained snapshot whose version differs from the current world (prior good)."
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      },
      "description": "Roll a (node, resource_type) back to a retained prior snapshot. The named\nnode's bounded `served_snapshots` ring supplies the target payloads; the\nserver re-publishes them through the SAME content-addressed registry the push\npath serves from, so every subscribing node converges back onto the retained\nversion. Fails closed (FAILED_PRECONDITION) when no matching snapshot is\nretained — a rollback never silently no-ops."
    },
    "IdentityProviderServiceDisableProviderBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "updatedBy": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "IdentityProviderServiceForceJwksRefreshBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        }
      }
    },
    "IdentityProviderServiceImportSamlMetadataBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "metadataXml": {
          "type": "string",
          "description": "Raw SAML metadata XML; if empty the stored saml_metadata_url is fetched."
        },
        "updatedBy": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      },
      "description": "Import IdP metadata (XML) into a provider record: SSO URL, entityID, certs."
    },
    "IdentityProviderServicePreviewClaimMappingBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "claimsJson": {
          "type": "string",
          "description": "Raw claims as a JSON object (the IdP token payload)."
        },
        "claimMappingJson": {
          "type": "string",
          "description": "Optional override mapping; empty = use the stored provider mapping."
        }
      },
      "description": "Preview how raw IdP claims would map to a UDB principal under a mapping."
    },
    "IdentityProviderServicePreviewGroupMappingBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "groups": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "groupMappingJson": {
          "type": "string",
          "title": "empty = use stored mapping"
        }
      },
      "description": "Preview which UDB roles a set of IdP groups would grant under a group mapping."
    },
    "IdentityProviderServiceResolveExternalIdentityBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "claimsJson": {
          "type": "string",
          "description": "Verified claims as JSON (already authenticated upstream)."
        }
      },
      "description": "Resolve (and JIT-provision/link) a UDB user from verified external claims."
    },
    "IdentityProviderServiceSamlAcsBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "samlResponse": {
          "type": "string",
          "description": "Base64-encoded SAMLResponse from the IdP (HTTP-POST binding)."
        },
        "relayState": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      },
      "description": "Assertion Consumer Service: validate a posted SAMLResponse and authenticate."
    },
    "IdentityProviderServiceScimCreateGroupBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "scimGroupJson": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "IdentityProviderServiceScimCreateUserBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "scimUserJson": {
          "type": "string",
          "title": "SCIM 2.0 User JSON"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "IdentityProviderServiceScimPatchGroupBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "operations": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ScimPatchOp"
          }
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "IdentityProviderServiceScimPatchUserBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "operations": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ScimPatchOp"
          }
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "IdentityProviderServiceScimReplaceUserBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "scimUserJson": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "IdentityProviderServiceStartSamlLoginBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "relayState": {
          "type": "string"
        }
      },
      "description": "Build a signed (or unsigned) SAML AuthnRequest for redirect to the IdP."
    },
    "IdentityProviderServiceTestProviderDiscoveryBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        }
      },
      "description": "Resolve discovery + key material for a provider without authenticating."
    },
    "IdentityProviderServiceUnlinkIdentityBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "IdentityProviderServiceUpdateProviderBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "displayName": {
          "type": "string"
        },
        "issuer": {
          "type": "string"
        },
        "entityId": {
          "type": "string"
        },
        "jwksUrl": {
          "type": "string"
        },
        "samlMetadataUrl": {
          "type": "string"
        },
        "clientIds": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "audiences": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "claimMappingJson": {
          "type": "string"
        },
        "groupMappingJson": {
          "type": "string"
        },
        "jitPolicyJson": {
          "type": "string"
        },
        "accountLinkingPolicy": {
          "type": "string"
        },
        "clientSecret": {
          "type": "string",
          "title": "empty = unchanged"
        },
        "samlSigningKeyPem": {
          "type": "string",
          "title": "empty = unchanged"
        },
        "updatedBy": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        },
        "updateMask": {
          "type": "string",
          "description": "Optional PATCH mask relative to the provider resource. When omitted, legacy\nclients keep the historical non-empty-field patch behavior."
        }
      }
    },
    "NotificationServiceReportDeliveryBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "channel": {
          "$ref": "#/definitions/v1NotificationChannel"
        },
        "provider": {
          "type": "string",
          "title": "SES | SMTP | TWILIO | FCM | …"
        },
        "status": {
          "$ref": "#/definitions/v1NotificationStatus",
          "title": "queued|sent|delivered|failed"
        },
        "providerMessageId": {
          "type": "string"
        },
        "errorMessage": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      },
      "description": "ReportDelivery — an internal/SDK seam. An authenticated caller (the leader\ndelivery worker) or a provider webhook bridge reports the terminal per-channel\ndelivery outcome for a previously-sent NotificationLog. The handler upserts the\nmatching NotificationDeliveryAttempt row and emits\n`udb.notification.delivery.<status>.v1` to the outbox."
    },
    "NotificationServiceRetryNotificationBody": {
      "type": "object",
      "properties": {
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "NotificationServiceSetPreferenceBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "eventType": {
          "type": "string",
          "title": "Empty = channel-wide opt-out"
        },
        "isOptedOut": {
          "type": "boolean"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "NotificationServiceUpsertTemplateBody": {
      "type": "object",
      "properties": {
        "locale": {
          "type": "string"
        },
        "subjectTemplate": {
          "type": "string"
        },
        "bodyTemplate": {
          "type": "string"
        },
        "isActive": {
          "type": "boolean"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "PeerServiceJoinRoomBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "displayName": {
          "type": "string"
        },
        "metadata": {
          "type": "string",
          "title": "JSON"
        },
        "userAgent": {
          "type": "string"
        }
      }
    },
    "PeerServiceLeaveRoomBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        }
      }
    },
    "RoomServiceCloseRoomBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        }
      }
    },
    "RoomServiceStartRoomCompositeBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "format": {
          "type": "string",
          "description": "Output container/format hint (e.g. \"mp4\", \"hls\"); backend-validated."
        },
        "destination": {
          "type": "string",
          "description": "Output destination URI (e.g. object-store key); backend-validated."
        },
        "options": {
          "type": "string",
          "description": "Optional layout/options as JSON."
        }
      },
      "description": "Start a composite (mixed) recording/egress of an entire room."
    },
    "RoomServiceStartTrackEgressBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "roomId": {
          "type": "string"
        },
        "format": {
          "type": "string",
          "description": "Output container/format hint; backend-validated."
        },
        "destination": {
          "type": "string",
          "description": "Output destination URI; backend-validated."
        },
        "options": {
          "type": "string",
          "description": "Optional options as JSON."
        }
      },
      "description": "Start an egress of a single published track."
    },
    "RoomServiceStopEgressBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        }
      },
      "description": "Stop a running egress. `egress_id` MUST be one returned to this tenant; the\nserver rejects an egress_id not scoped to the verified tenant."
    },
    "RoomServiceUpdateRoomBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "state": {
          "type": "string"
        },
        "config": {
          "type": "string",
          "title": "JSON"
        },
        "updateMask": {
          "type": "string",
          "description": "Optional PATCH mask relative to the room resource. When omitted, legacy\nclients keep the historical non-empty-field patch behavior."
        }
      }
    },
    "SchedulerServicePauseJobBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        }
      }
    },
    "SchedulerServiceResumeJobBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        }
      }
    },
    "StorageServiceFinalizeUploadBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "contentType": {
          "type": "string"
        },
        "fileType": {
          "type": "string"
        },
        "referenceId": {
          "type": "string"
        },
        "referenceType": {
          "type": "string"
        },
        "isPublic": {
          "type": "boolean",
          "description": "Proto3 explicit presence: absent leaves the stored visibility unchanged."
        },
        "sizeBytes": {
          "type": "string",
          "format": "int64",
          "description": "Actual uploaded size in bytes, persisted on finalize."
        },
        "checksum": {
          "type": "string",
          "description": "Optional client-computed content checksum; persisted into File.checksum.\nOnly verified/stored when present."
        },
        "etag": {
          "type": "string",
          "description": "Optional client-observed object ETag; compared against the store's HEAD\nETag when present (mismatch → FailedPrecondition / UPLOAD_SIZE_MISMATCH)."
        }
      }
    },
    "StorageServiceSetScanVerdictBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "verdict": {
          "$ref": "#/definitions/v1ScanVerdict",
          "description": "Required. UNSPECIFIED is refused: a scanner reporting \"no verdict\" would\notherwise silently clear a previously recorded INFECTED."
        },
        "detail": {
          "type": "string",
          "description": "Signature name for INFECTED, failure reason for FAILED. Optional."
        },
        "scannedAt": {
          "type": "string",
          "format": "date-time",
          "description": "When the engine produced the verdict. Absent means \"now\"."
        },
        "idempotencyKey": {
          "type": "string",
          "description": "Idempotency key so a scanner retry does not emit a second CDC transition."
        }
      }
    },
    "StorageServiceUpdateFileBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "filename": {
          "type": "string"
        },
        "contentType": {
          "type": "string"
        },
        "fileType": {
          "type": "string"
        },
        "referenceId": {
          "type": "string"
        },
        "referenceType": {
          "type": "string"
        },
        "isPublic": {
          "type": "boolean",
          "description": "Proto3 explicit presence: absent leaves the stored visibility unchanged —\na partial update can never silently flip a file public/private."
        },
        "updateMask": {
          "type": "string",
          "description": "Optional PATCH mask relative to the file resource. When omitted, legacy\nclients keep the historical non-empty-field patch behavior."
        }
      }
    },
    "TenantServiceAdminPurgeTenantBody": {
      "type": "object",
      "properties": {
        "delegatedActor": {
          "type": "string",
          "description": "Actor on whose behalf the purge is delegated (audit attribution). The server\nbinds this to the VERIFIED caller subject: empty inherits the caller; a\nnon-empty value that disagrees with the caller is accepted ONLY from a genuine\ncross-tenant admin, otherwise rejected (attribution cannot be forged)."
        },
        "mode": {
          "$ref": "#/definitions/v1AdminPurgeMode",
          "description": "Destructive treatment; ADMIN_PURGE_MODE_UNSPECIFIED is rejected."
        },
        "reason": {
          "type": "string",
          "description": "Mandatory human-readable justification, recorded in the immutable audit record."
        },
        "expectedVersion": {
          "type": "string",
          "format": "int64",
          "description": "Optimistic-concurrency guard against the tenant's current version (its\nupdated-at epoch seconds). `0` disables the check; a non-zero mismatch is an\nAborted conflict so a stale operator view never purges a changed tenant."
        },
        "confirmationToken": {
          "type": "string",
          "description": "Required explicit confirmation. To guard against a fat-fingered cross-tenant\npurge it MUST equal `target_tenant_id`; empty or non-matching fails closed."
        },
        "idempotencyKey": {
          "type": "string",
          "description": "Required caller-supplied idempotency key. A replay with the SAME key and SAME\ninputs returns the original outcome; the same key with DIFFERENT inputs is a\nconflict (never a bogus replay)."
        }
      }
    },
    "TenantServicePurgeTenantBody": {
      "type": "object",
      "properties": {
        "confirmationToken": {
          "type": "string",
          "description": "Required explicit confirmation token. The purge is an irreversible HARD\ndelete; an empty or non-matching token MUST fail closed (DESTRUCTIVE)."
        }
      }
    },
    "TenantServiceUpdateTenantBody": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "config": {
          "type": "string",
          "title": "JSON"
        },
        "branding": {
          "type": "string",
          "title": "JSON"
        },
        "updateMask": {
          "type": "string",
          "description": "Optional PATCH mask relative to the tenant resource. When omitted, legacy\nclients keep the historical non-empty-field patch behavior."
        }
      }
    },
    "TenantServiceUpdateTenantConfigBody": {
      "type": "object",
      "properties": {
        "configKey": {
          "type": "string"
        },
        "configValue": {
          "type": "string"
        },
        "type": {
          "type": "string"
        }
      }
    },
    "TrackServiceMuteTrackBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "muted": {
          "type": "boolean"
        }
      }
    },
    "TrackServiceUnpublishTrackBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        }
      }
    },
    "VaultServiceRevokeDatabaseCredentialsBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        }
      }
    },
    "WebhookServiceUpdateEndpointBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "url": {
          "type": "string"
        },
        "topicPattern": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "active": {
          "type": "boolean"
        },
        "maxAttempts": {
          "type": "integer",
          "format": "int32"
        },
        "updateMask": {
          "type": "string",
          "description": "Optional PATCH mask relative to the webhook endpoint resource. When omitted,\nlegacy clients keep the historical non-empty-field patch behavior."
        }
      }
    },
    "WorkflowServiceCancelWorkflowBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        }
      }
    },
    "WorkflowServiceSignalWorkflowBody": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "signalName": {
          "type": "string"
        },
        "signalPayload": {
          "type": "string"
        }
      }
    },
    "coreAuthnServicesV1Principal": {
      "type": "object",
      "properties": {
        "principalId": {
          "type": "string"
        },
        "subject": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        },
        "serviceIdentity": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "providerId": {
          "type": "string"
        },
        "authMethod": {
          "type": "string"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "accountKind": {
          "$ref": "#/definitions/v1AccountKind"
        },
        "domain": {
          "type": "string"
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      },
      "description": "An authenticated caller, normalized to the claims UDB and project services\nneed after token/session/API-key validation."
    },
    "coreAuthzServicesV1Principal": {
      "type": "object",
      "properties": {
        "principalId": {
          "type": "string"
        },
        "subject": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        },
        "serviceIdentity": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "providerId": {
          "type": "string"
        },
        "authMethod": {
          "type": "string"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "accountKind": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      },
      "description": "Authenticated caller claims copied from the UDB auth control plane and kept\nlocal so authorization can be used by any project without importing broker\nservice protos."
    },
    "coreCommonV1RequestContext": {
      "type": "object",
      "properties": {
        "tenant": {
          "$ref": "#/definitions/v1TenantContext"
        },
        "requestId": {
          "type": "string"
        },
        "correlationId": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        },
        "headers": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "traceId": {
          "type": "string"
        },
        "spanId": {
          "type": "string"
        },
        "ipAddress": {
          "type": "string"
        },
        "userAgent": {
          "type": "string"
        },
        "timestamp": {
          "type": "string",
          "format": "date-time"
        },
        "principalId": {
          "type": "string"
        },
        "serviceIdentity": {
          "type": "string"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "purpose": {
          "type": "string"
        },
        "idempotencyKey": {
          "type": "string"
        },
        "clientCatalogVersion": {
          "type": "string"
        },
        "consistency": {
          "type": "string"
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "traceparent": {
          "type": "string"
        }
      }
    },
    "lockServicesV1Lock": {
      "type": "object",
      "properties": {
        "lockId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "lockName": {
          "type": "string"
        },
        "ownerId": {
          "type": "string"
        },
        "fencingToken": {
          "type": "string",
          "format": "int64"
        },
        "leaseTtlSeconds": {
          "type": "integer",
          "format": "int32"
        },
        "status": {
          "type": "string"
        },
        "acquiredAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "metadataJson": {
          "type": "string"
        }
      },
      "description": "Read-only projection of a durable `udb_lock.locks` row for GetLock/ListLocks.\nTimestamps are unix seconds (SDK-friendly, no well-known-type import in the\nservices surface). metadata_json is the declared non-secret holder metadata."
    },
    "protobufAny": {
      "type": "object",
      "properties": {
        "@type": {
          "type": "string",
          "description": "A URL/resource name that uniquely identifies the type of the serialized\nprotocol buffer message. This string must contain at least\none \"/\" character. The last segment of the URL's path must represent\nthe fully qualified name of the type (as in\n`path/google.protobuf.Duration`). The name should be in a canonical form\n(e.g., leading \".\" is not accepted).\n\nIn practice, teams usually precompile into the binary all types that they\nexpect it to use in the context of Any. However, for URLs which use the\nscheme `http`, `https`, or no scheme, one can optionally set up a type\nserver that maps type URLs to message definitions as follows:\n\n* If no scheme is provided, `https` is assumed.\n* An HTTP GET on the URL must yield a [google.protobuf.Type][]\n  value in binary format, or produce an error.\n* Applications are allowed to cache lookup results based on the\n  URL, or have them precompiled into a binary to avoid any\n  lookup. Therefore, binary compatibility needs to be preserved\n  on changes to types. (Use versioned type names to manage\n  breaking changes.)\n\nNote: this functionality is not currently available in the official\nprotobuf release, and it is not used for type URLs beginning with\ntype.googleapis.com. As of May 2023, there are no widely used type server\nimplementations and no plans to implement one.\n\nSchemes other than `http`, `https` (or the empty scheme) might be\nused with implementation specific semantics."
        }
      },
      "additionalProperties": {},
      "description": "`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nProtobuf library provides support to pack/unpack Any values in the form\nof utility functions or additional generated methods of the Any type.\n\nExample 1: Pack and unpack a message in C++.\n\n    Foo foo = ...;\n    Any any;\n    any.PackFrom(foo);\n    ...\n    if (any.UnpackTo(&foo)) {\n      ...\n    }\n\nExample 2: Pack and unpack a message in Java.\n\n    Foo foo = ...;\n    Any any = Any.pack(foo);\n    ...\n    if (any.is(Foo.class)) {\n      foo = any.unpack(Foo.class);\n    }\n    // or ...\n    if (any.isSameTypeAs(Foo.getDefaultInstance())) {\n      foo = any.unpack(Foo.getDefaultInstance());\n    }\n\n Example 3: Pack and unpack a message in Python.\n\n    foo = Foo(...)\n    any = Any()\n    any.Pack(foo)\n    ...\n    if any.Is(Foo.DESCRIPTOR):\n      any.Unpack(foo)\n      ...\n\n Example 4: Pack and unpack a message in Go\n\n     foo := &pb.Foo{...}\n     any, err := anypb.New(foo)\n     if err != nil {\n       ...\n     }\n     ...\n     foo := &pb.Foo{}\n     if err := any.UnmarshalTo(foo); err != nil {\n       ...\n     }\n\nThe pack methods provided by protobuf library will by default use\n'type.googleapis.com/full.type.name' as the type URL and the unpack\nmethods only use the fully qualified type name after the last '/'\nin the type URL, for example \"foo.bar.com/x/y.z\" will yield type\nname \"y.z\".\n\nJSON\n====\nThe JSON representation of an `Any` value uses the regular\nrepresentation of the deserialized, embedded message, with an\nadditional field `@type` which contains the type URL. Example:\n\n    package google.profile;\n    message Person {\n      string first_name = 1;\n      string last_name = 2;\n    }\n\n    {\n      \"@type\": \"type.googleapis.com/google.profile.Person\",\n      \"firstName\": <string>,\n      \"lastName\": <string>\n    }\n\nIf the embedded message type is well-known and has a custom JSON\nrepresentation, that representation will be embedded adding a field\n`value` which holds the custom JSON in addition to the `@type`\nfield. Example (for message [google.protobuf.Duration][]):\n\n    {\n      \"@type\": \"type.googleapis.com/google.protobuf.Duration\",\n      \"value\": \"1.212s\"\n    }"
    },
    "rpcStatus": {
      "type": "object",
      "properties": {
        "code": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "details": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/protobufAny"
          }
        }
      }
    },
    "v1AccessContext": {
      "type": "object",
      "properties": {
        "ipAddress": {
          "type": "string"
        },
        "userAgent": {
          "type": "string"
        },
        "deviceId": {
          "type": "string"
        },
        "tokenId": {
          "type": "string"
        },
        "sessionId": {
          "type": "string"
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "v1AccessDecisionAudit": {
      "type": "object",
      "properties": {
        "decisionAuditId": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        },
        "object": {
          "type": "string"
        },
        "action": {
          "type": "string"
        },
        "effect": {
          "$ref": "#/definitions/v1PolicyEffect"
        },
        "decisionSource": {
          "$ref": "#/definitions/v1DecisionSource"
        },
        "matchedRule": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        },
        "ipAddress": {
          "type": "string"
        },
        "correlationId": {
          "type": "string"
        },
        "decidedAt": {
          "type": "string",
          "format": "date-time"
        },
        "tenantId": {
          "type": "string"
        },
        "decisionId": {
          "type": "string",
          "description": "── Phase L3 task4: expanded compliance columns ───────────────────────────\nStable decision id linking this audit row to the gRPC Decision returned to\nthe caller and to the access-deny domain event."
        },
        "policyVersion": {
          "type": "string",
          "description": "Authz snapshot versions at decision time."
        },
        "relationshipVersion": {
          "type": "string"
        },
        "purpose": {
          "type": "string",
          "description": "Declared purpose of the access (purpose-binding / GDPR)."
        },
        "scopes": {
          "type": "string",
          "description": "Scopes required by the matched policy (comma-joined)."
        },
        "matchedPolicyIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Every policy id that matched (Postgres text array), not just the first."
        },
        "projectId": {
          "type": "string",
          "description": "Project domain (tenant lives on tenant_id)."
        },
        "actorKind": {
          "type": "string",
          "description": "Actor kind: \"user\" | \"service\" | \"external\"."
        },
        "resourceType": {
          "type": "string",
          "description": "Resource type/reference for the object being acted upon."
        },
        "traceId": {
          "type": "string",
          "description": "Distributed-trace correlation (OpenTelemetry)."
        },
        "spanId": {
          "type": "string"
        },
        "userAgentHash": {
          "type": "string",
          "description": "Hashed user-agent (never raw) from the request context."
        },
        "decisionInput": {
          "type": "string",
          "description": "Redacted decision-input attributes (JSON; credential-shaped keys scrubbed)."
        }
      }
    },
    "v1AccountKind": {
      "type": "string",
      "enum": [
        "ACCOUNT_KIND_UNSPECIFIED",
        "ACCOUNT_KIND_PERSON",
        "ACCOUNT_KIND_SERVICE_ACCOUNT",
        "ACCOUNT_KIND_WORKLOAD",
        "ACCOUNT_KIND_EXTERNAL_IDENTITY",
        "ACCOUNT_KIND_SYSTEM",
        "ACCOUNT_KIND_ANONYMOUS"
      ],
      "default": "ACCOUNT_KIND_UNSPECIFIED",
      "description": "Generic principal category used by native authn, external identity mapping,\nAPI keys, and workload/service accounts."
    },
    "v1AckStatusResponse": {
      "type": "object",
      "properties": {
        "nodeState": {
          "$ref": "#/definitions/v1NodeAckState"
        },
        "currentVersion": {
          "type": "string",
          "description": "The current version-of-the-world for this resource_type."
        },
        "acknowledged": {
          "type": "boolean",
          "description": "True iff the node has applied the current version with no outstanding NACK."
        },
        "nacked": {
          "type": "boolean",
          "description": "True iff the node's last response was rejected (NACK) and not yet recovered."
        }
      }
    },
    "v1AcquireLockRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected."
        },
        "lockName": {
          "type": "string"
        },
        "ownerId": {
          "type": "string"
        },
        "leaseTtlSeconds": {
          "type": "integer",
          "format": "int32"
        },
        "metadataJson": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1AcquireLockResponse": {
      "type": "object",
      "properties": {
        "acquired": {
          "type": "boolean"
        },
        "fencingToken": {
          "type": "string",
          "format": "int64"
        },
        "lockName": {
          "type": "string"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1ActivateCanaryRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "policyVersionId": {
          "type": "string"
        },
        "scopeKind": {
          "$ref": "#/definitions/v1CanaryScopeKind"
        },
        "scopeValues": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "NODE/TENANT: explicit id list. PERCENT: a single value 1..=100."
        },
        "successWindowSecs": {
          "type": "string",
          "format": "int64",
          "description": "Evaluator settings (zero = service defaults)."
        },
        "metricThreshold": {
          "type": "number",
          "format": "double"
        },
        "minSamples": {
          "type": "string",
          "format": "int64"
        },
        "expectedRevision": {
          "type": "string",
          "format": "int64",
          "description": "Optimistic concurrency over the candidate version's own revision."
        }
      },
      "description": "Activate a policy version to a CANARY scope (a subset of the fleet) rather\nthan fleet-wide. The version is served only to in-scope nodes/tenants (or a\npercentage slice) while a metric-based evaluator watches the success window;\nit then either promotes fleet-wide, auto-rolls back on breach, or pauses on\nan inconclusive signal. Additive to the Phase-K activation surface."
    },
    "v1ActivatePolicyVersionRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "policyVersionId": {
          "type": "string"
        },
        "expectedRevision": {
          "type": "string",
          "format": "int64"
        },
        "expectedPolicyRevision": {
          "type": "string",
          "format": "int64",
          "description": "Optimistic concurrency over the live authz revision counters."
        },
        "expectedRelationshipRevision": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1ActivationResponse": {
      "type": "object",
      "properties": {
        "version": {
          "$ref": "#/definitions/v1PolicyVersion"
        },
        "policySet": {
          "$ref": "#/definitions/v1PolicySet"
        },
        "policyRevision": {
          "type": "string",
          "format": "int64",
          "description": "The authz revision the activation/rollback produced (for cluster reload)."
        },
        "relationshipRevision": {
          "type": "string",
          "format": "int64"
        },
        "contentHash": {
          "type": "string"
        }
      }
    },
    "v1AdminPurgeMode": {
      "type": "string",
      "enum": [
        "ADMIN_PURGE_MODE_UNSPECIFIED",
        "ADMIN_PURGE_MODE_HARD",
        "ADMIN_PURGE_MODE_SOFT"
      ],
      "default": "ADMIN_PURGE_MODE_UNSPECIFIED",
      "description": "Treatment the privileged AdminPurgeTenant applies to the target tenant's data.\nUNSPECIFIED is rejected (fail closed) so the destructive blast radius is always\nchosen explicitly, never defaulted.\n\n - ADMIN_PURGE_MODE_HARD: Physically HARD-deletes every row the tenant owns across all tenant-columned\nentity tables (the same ripple as PurgeTenant). Irreversible.\n - ADMIN_PURGE_MODE_SOFT: Reversible: deactivates the tenant control record (soft-delete + INACTIVE) and\nrevokes its tokens WITHOUT physically deleting entity rows. Every tenant-owned\ntable is REPORTED as retained so the operator sees data was preserved."
    },
    "v1AdminPurgeTenantResponse": {
      "type": "object",
      "properties": {
        "targetTenantId": {
          "type": "string"
        },
        "mode": {
          "$ref": "#/definitions/v1AdminPurgeMode",
          "description": "The treatment actually applied (echoes the request mode)."
        },
        "purged": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PurgedTableCount"
          },
          "description": "HARD: per-table hard-delete counts (children->parents). SOFT: empty."
        },
        "excluded": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PurgeExcludedTable"
          },
          "description": "Tables NOT physically purged, reported for capability honesty: tenant-less /\ncontrol-plane tables (both modes), and — in SOFT mode — every tenant-owned\ntable whose data was deliberately retained."
        },
        "totalDeleted": {
          "type": "string",
          "format": "uint64"
        },
        "tenantDenylisted": {
          "type": "boolean",
          "description": "Whether the tenant-level cluster denylist cutoff was recorded (best-effort)."
        },
        "principalsDenylisted": {
          "type": "integer",
          "format": "int64",
          "description": "How many principals had a denylist cutoff recorded (best-effort)."
        },
        "softDeactivated": {
          "type": "boolean",
          "description": "SOFT mode: the tenant control record was deactivated (soft-deleted), data kept."
        },
        "purgedVersion": {
          "type": "string",
          "format": "int64",
          "description": "The tenant version observed at purge time (see AdminPurgeTenantRequest.expected_version)."
        },
        "replayed": {
          "type": "boolean",
          "description": "True when this response was replayed from a prior identical request (idempotency)."
        },
        "outcomeId": {
          "type": "string",
          "description": "Id of the immutable audit/outcome record written for this purge."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1AdminResetMfaResponse": {
      "type": "object",
      "properties": {
        "reset": {
          "type": "boolean"
        }
      }
    },
    "v1AdminResetPasswordResponse": {
      "type": "object",
      "properties": {
        "otpId": {
          "type": "string",
          "title": "OTP to complete the reset flow"
        }
      }
    },
    "v1AdminRevokeAllTenantSessionsResponse": {
      "type": "object",
      "properties": {
        "sessionsRevoked": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1AdminRevokeAllUserSessionsResponse": {
      "type": "object",
      "properties": {
        "sessionsRevoked": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1AdminRevokeSessionResponse": {
      "type": "object",
      "properties": {
        "revoked": {
          "type": "boolean"
        },
        "sessionsRevoked": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1ApiError": {
      "type": "object",
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "errorId": {
          "type": "string"
        },
        "httpStatusCode": {
          "type": "integer",
          "format": "int32"
        },
        "retryable": {
          "type": "boolean"
        },
        "fieldViolations": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1FieldViolation"
          }
        }
      },
      "description": "ApiError holds structured error information for failed responses."
    },
    "v1ApiKey": {
      "type": "object",
      "properties": {
        "keyId": {
          "type": "string"
        },
        "keyPrefix": {
          "type": "string",
          "description": "Prefix stored for display (for example \"udb_ab1c\"). Not secret; only for UX."
        },
        "keyHash": {
          "type": "string",
          "description": "Keyed digest of the full plain key — used for lookup + equality check."
        },
        "name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "ownerType": {
          "$ref": "#/definitions/v1ApiKeyOwnerType"
        },
        "ownerId": {
          "type": "string",
          "description": "Owning principal, tenant, project, integration, service account, or workload id."
        },
        "scopesJson": {
          "type": "string",
          "description": "JSON array of scopes granted to this key."
        },
        "status": {
          "$ref": "#/definitions/v1ApiKeyStatus"
        },
        "ipAllowlistJson": {
          "type": "string",
          "description": "IP allowlist — JSON array of CIDR strings. Empty = unrestricted."
        },
        "rateLimitPerMinute": {
          "type": "integer",
          "format": "int32",
          "title": "Rate limits (0 = unlimited)"
        },
        "rateLimitPerDay": {
          "type": "string",
          "format": "int64"
        },
        "createdBy": {
          "type": "string"
        },
        "revokedBy": {
          "type": "string"
        },
        "revokeReason": {
          "type": "string"
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time"
        },
        "lastUsedAt": {
          "type": "string",
          "format": "date-time"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedBy": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "allowedResourcesJson": {
          "type": "string"
        },
        "metadataJson": {
          "type": "string"
        }
      }
    },
    "v1ApiKeyDailyStat": {
      "type": "object",
      "properties": {
        "date": {
          "type": "string",
          "title": "YYYY-MM-DD"
        },
        "totalRequests": {
          "type": "string",
          "format": "int64"
        },
        "rateLimitedCount": {
          "type": "string",
          "format": "int64"
        },
        "avgLatencyMs": {
          "type": "number",
          "format": "double"
        },
        "statusCounts": {
          "type": "object",
          "additionalProperties": {
            "type": "string",
            "format": "int64"
          },
          "title": "HTTP status → count"
        }
      }
    },
    "v1ApiKeyOwnerType": {
      "type": "string",
      "enum": [
        "API_KEY_OWNER_TYPE_UNSPECIFIED",
        "API_KEY_OWNER_TYPE_INTEGRATION",
        "API_KEY_OWNER_TYPE_CICD",
        "API_KEY_OWNER_TYPE_ANALYTICS",
        "API_KEY_OWNER_TYPE_TENANT",
        "API_KEY_OWNER_TYPE_PROJECT",
        "API_KEY_OWNER_TYPE_SERVICE_ACCOUNT",
        "API_KEY_OWNER_TYPE_WORKLOAD"
      ],
      "default": "API_KEY_OWNER_TYPE_UNSPECIFIED",
      "description": "- API_KEY_OWNER_TYPE_INTEGRATION: External system integration.\n - API_KEY_OWNER_TYPE_CICD: CI/CD pipeline\n - API_KEY_OWNER_TYPE_ANALYTICS: Read-only analytics / BI tool\n - API_KEY_OWNER_TYPE_TENANT: Tenant-scoped integration key\n - API_KEY_OWNER_TYPE_PROJECT: Project/application-scoped key",
      "title": "Owner types — who this key belongs to"
    },
    "v1ApiKeyStatus": {
      "type": "string",
      "enum": [
        "API_KEY_STATUS_UNSPECIFIED",
        "API_KEY_STATUS_ACTIVE",
        "API_KEY_STATUS_REVOKED",
        "API_KEY_STATUS_EXPIRED"
      ],
      "default": "API_KEY_STATUS_UNSPECIFIED"
    },
    "v1ApprovePolicyDraftRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "draftId": {
          "type": "string"
        },
        "reviewer": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        }
      }
    },
    "v1Asset": {
      "type": "object",
      "properties": {
        "assetId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:asset_id;not null\""
        },
        "tenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:tenant_id;not null\""
        },
        "projectId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:project_id\""
        },
        "fileId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:file_id;not null\""
        },
        "name": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:name\""
        },
        "mediaType": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:media_type\""
        },
        "status": {
          "$ref": "#/definitions/v1AssetStatus",
          "title": "@inject_tag: gorm:\"column:status;not null;serializer:proto_enum\""
        },
        "metadata": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:metadata\""
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedBy": {
          "type": "string"
        }
      },
      "description": "Asset wraps a storage File and tracks its processing lifecycle."
    },
    "v1AssetStatus": {
      "type": "string",
      "enum": [
        "ASSET_STATUS_UNSPECIFIED",
        "ASSET_STATUS_PENDING",
        "ASSET_STATUS_READY",
        "ASSET_STATUS_FAILED"
      ],
      "default": "ASSET_STATUS_UNSPECIFIED"
    },
    "v1AssignRoleResponse": {
      "type": "object",
      "properties": {
        "userRole": {
          "$ref": "#/definitions/v1UserRole"
        }
      }
    },
    "v1AssuranceLevel": {
      "type": "string",
      "enum": [
        "ASSURANCE_LEVEL_UNSPECIFIED",
        "ASSURANCE_LEVEL_NONE",
        "ASSURANCE_LEVEL_LOW",
        "ASSURANCE_LEVEL_SINGLE_FACTOR",
        "ASSURANCE_LEVEL_MULTI_FACTOR",
        "ASSURANCE_LEVEL_HARDWARE"
      ],
      "default": "ASSURANCE_LEVEL_UNSPECIFIED",
      "description": "Normalized authentication assurance level derived from IdP auth-context /\nMFA claims. Higher ordinal == stronger assurance. Authz policies (Phase K)\nmay require a minimum assurance level; the value is stamped onto sessions and\naudit records so a decision can be correlated to how the subject authenticated.\n\n - ASSURANCE_LEVEL_NONE: unauthenticated / anonymous\n - ASSURANCE_LEVEL_LOW: single factor, unverified context\n - ASSURANCE_LEVEL_SINGLE_FACTOR: single factor, verified (pwd / IdP w/o MFA)\n - ASSURANCE_LEVEL_MULTI_FACTOR: MFA asserted by IdP (amr/acr)\n - ASSURANCE_LEVEL_HARDWARE: phishing-resistant / hardware-backed (WebAuthn, smartcard)"
    },
    "v1AuditInfo": {
      "type": "object",
      "properties": {
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "createdBy": {
          "type": "string"
        },
        "updatedBy": {
          "type": "string"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedBy": {
          "type": "string"
        }
      }
    },
    "v1AuthCredentialType": {
      "type": "string",
      "enum": [
        "AUTH_CREDENTIAL_TYPE_UNSPECIFIED",
        "AUTH_CREDENTIAL_TYPE_BEARER_TOKEN",
        "AUTH_CREDENTIAL_TYPE_SESSION",
        "AUTH_CREDENTIAL_TYPE_API_KEY",
        "AUTH_CREDENTIAL_TYPE_MTLS",
        "AUTH_CREDENTIAL_TYPE_OIDC_TOKEN",
        "AUTH_CREDENTIAL_TYPE_SAML_ASSERTION",
        "AUTH_CREDENTIAL_TYPE_PASSWORD",
        "AUTH_CREDENTIAL_TYPE_CUSTOM"
      ],
      "default": "AUTH_CREDENTIAL_TYPE_UNSPECIFIED"
    },
    "v1AuthFactorKind": {
      "type": "string",
      "enum": [
        "AUTH_FACTOR_KIND_UNSPECIFIED",
        "AUTH_FACTOR_KIND_PASSWORD",
        "AUTH_FACTOR_KIND_EMAIL_OTP",
        "AUTH_FACTOR_KIND_SMS_OTP",
        "AUTH_FACTOR_KIND_TOTP",
        "AUTH_FACTOR_KIND_WEBAUTHN",
        "AUTH_FACTOR_KIND_RECOVERY_CODE"
      ],
      "default": "AUTH_FACTOR_KIND_UNSPECIFIED"
    },
    "v1AuthMutationResponse": {
      "type": "object",
      "properties": {
        "ok": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        }
      }
    },
    "v1AuthnRequest": {
      "type": "object",
      "properties": {
        "bearerToken": {
          "type": "string"
        },
        "sessionId": {
          "type": "string"
        },
        "apiKey": {
          "type": "string"
        },
        "externalProviderId": {
          "type": "string"
        },
        "externalToken": {
          "type": "string"
        },
        "tenantHint": {
          "type": "string"
        },
        "projectHint": {
          "type": "string"
        },
        "requestedScopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "credentialType": {
          "$ref": "#/definitions/v1AuthCredentialType"
        },
        "clientId": {
          "type": "string"
        },
        "audience": {
          "type": "string"
        },
        "issuer": {
          "type": "string"
        }
      }
    },
    "v1AuthnResponse": {
      "type": "object",
      "properties": {
        "principal": {
          "$ref": "#/definitions/coreAuthnServicesV1Principal"
        },
        "sessionId": {
          "type": "string"
        },
        "accessToken": {
          "type": "string"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "relationshipVersion": {
          "type": "string"
        },
        "warnings": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "v1AuthzPolicyRecord": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "priority": {
          "type": "integer",
          "format": "int32"
        },
        "enabled": {
          "type": "boolean"
        },
        "effect": {
          "type": "string"
        },
        "tenant": {
          "type": "string"
        },
        "project": {
          "type": "string"
        },
        "subject": {
          "type": "string"
        },
        "role": {
          "type": "string"
        },
        "action": {
          "type": "string"
        },
        "resource": {
          "type": "string"
        },
        "purpose": {
          "type": "string"
        },
        "relationship": {
          "type": "string"
        },
        "conditions": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "requiredScopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "v1AuthzRequest": {
      "type": "object",
      "properties": {
        "principal": {
          "$ref": "#/definitions/coreAuthzServicesV1Principal"
        },
        "sessionId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "resource": {
          "$ref": "#/definitions/v1ResourceRef"
        },
        "action": {
          "type": "string"
        },
        "purpose": {
          "type": "string"
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "context": {
          "$ref": "#/definitions/v1AccessContext"
        },
        "requestedScopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "domain": {
          "type": "string"
        }
      }
    },
    "v1AuthzResponse": {
      "type": "object",
      "properties": {
        "decision": {
          "$ref": "#/definitions/v1Decision"
        }
      }
    },
    "v1BackfillRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "sourceName": {
          "type": "string"
        },
        "mode": {
          "type": "string",
          "description": "INCREMENTAL skips unchanged chunk hashes; FULL re-emits every chunk."
        }
      }
    },
    "v1BackfillResponse": {
      "type": "object",
      "properties": {
        "backfillId": {
          "type": "string"
        },
        "accepted": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1BackupExcludedTable": {
      "type": "object",
      "properties": {
        "schema": {
          "type": "string"
        },
        "table": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        }
      },
      "description": "A table excluded from the backup because it has no resolvable tenant column.\nReported, never silently skipped."
    },
    "v1BackupPolicyView": {
      "type": "object",
      "properties": {
        "policyId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "policyName": {
          "type": "string"
        },
        "scheduleCron": {
          "type": "string"
        },
        "retentionDays": {
          "type": "integer",
          "format": "int32"
        },
        "maxRetainedBackups": {
          "type": "integer",
          "format": "int32"
        },
        "enabled": {
          "type": "boolean"
        },
        "objectBackend": {
          "type": "string"
        },
        "objectBucket": {
          "type": "string"
        },
        "createdAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "updatedAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "projectId": {
          "type": "string",
          "description": "First-class project owner of this policy."
        }
      },
      "description": "A backup retention/schedule policy."
    },
    "v1BackupRunSummary": {
      "type": "object",
      "properties": {
        "backupId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "kind": {
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "objectPrefix": {
          "type": "string"
        },
        "manifestChecksum": {
          "type": "string"
        },
        "tableCount": {
          "type": "integer",
          "format": "int32"
        },
        "totalRows": {
          "type": "string",
          "format": "int64"
        },
        "excludedCount": {
          "type": "integer",
          "format": "int32"
        },
        "sourceTenantId": {
          "type": "string"
        },
        "targetTenantId": {
          "type": "string"
        },
        "createdAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "completedAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "projectId": {
          "type": "string",
          "description": "First-class project owner of this journal row."
        }
      },
      "description": "A backup/restore journal row."
    },
    "v1BackupTableEntry": {
      "type": "object",
      "properties": {
        "schema": {
          "type": "string"
        },
        "table": {
          "type": "string"
        },
        "tenantColumn": {
          "type": "string"
        },
        "objectKey": {
          "type": "string"
        },
        "rowCount": {
          "type": "string",
          "format": "int64"
        },
        "checksumSha256": {
          "type": "string"
        }
      },
      "description": "One backed-up tenant table: where its encrypted JSONL artifact lives and its\nintegrity anchor."
    },
    "v1BatchCheckPermissionsRequest": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        },
        "checks": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PermissionCheck"
          }
        },
        "context": {
          "$ref": "#/definitions/v1AccessContext"
        }
      }
    },
    "v1BatchCheckPermissionsResponse": {
      "type": "object",
      "properties": {
        "results": {
          "type": "object",
          "additionalProperties": {
            "type": "boolean"
          },
          "title": "\"object:action\" → allowed"
        }
      }
    },
    "v1BatchDecryptRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        },
        "ciphertexts": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "v1BatchDecryptResponse": {
      "type": "object",
      "properties": {
        "plaintexts": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1BatchEncryptRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        },
        "plaintexts": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "v1BatchEncryptResponse": {
      "type": "object",
      "properties": {
        "ciphertexts": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "keyVersion": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1CacheItem": {
      "type": "object",
      "properties": {
        "key": {
          "type": "string"
        },
        "value": {
          "type": "string",
          "format": "byte"
        },
        "ttlRemainingSeconds": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "One scanned namespace entry. `key` is the namespace-local key (the\n`udb:cache:<tenant>:<ns>:` prefix is stripped before it leaves the server)."
    },
    "v1CanaryResponse": {
      "type": "object",
      "properties": {
        "canary": {
          "$ref": "#/definitions/v1PolicyCanary"
        },
        "version": {
          "$ref": "#/definitions/v1PolicyVersion"
        },
        "policySet": {
          "$ref": "#/definitions/v1PolicySet"
        }
      }
    },
    "v1CanaryScopeKind": {
      "type": "string",
      "enum": [
        "CANARY_SCOPE_KIND_UNSPECIFIED",
        "CANARY_SCOPE_KIND_NODE",
        "CANARY_SCOPE_KIND_TENANT",
        "CANARY_SCOPE_KIND_PERCENT"
      ],
      "default": "CANARY_SCOPE_KIND_UNSPECIFIED",
      "description": "How a canary's exposure is scoped before fleet-wide promotion. A canary\nversion is only served to in-scope nodes/tenants (or a percentage slice)\nwhile it bakes; the metric evaluator then either promotes it fleet-wide or\nauto-rolls it back.\n\n - CANARY_SCOPE_KIND_NODE: scope_values is an explicit list of control-plane node ids.\n - CANARY_SCOPE_KIND_TENANT: scope_values is an explicit list of tenant ids.\n - CANARY_SCOPE_KIND_PERCENT: scope_values[0] is an integer 1..=100 percentage; membership is a stable\nhash bucket of the node/tenant id."
    },
    "v1CanaryState": {
      "type": "string",
      "enum": [
        "CANARY_STATE_UNSPECIFIED",
        "CANARY_STATE_ACTIVE",
        "CANARY_STATE_PROMOTED",
        "CANARY_STATE_ROLLED_BACK",
        "CANARY_STATE_PAUSED"
      ],
      "default": "CANARY_STATE_UNSPECIFIED",
      "description": "Lifecycle state of a progressive-rollout canary.\n\n - CANARY_STATE_ACTIVE: Baking: the version is live for the in-scope subset and the evaluator is\nwatching the success metric over the success window.\n - CANARY_STATE_PROMOTED: The success window passed within threshold and the canary was promoted\nfleet-wide (the version is now the active version of its policy set).\n - CANARY_STATE_ROLLED_BACK: A metric breach inside the window triggered an automatic rollback to the\npolicy set's prior (rollback) version.\n - CANARY_STATE_PAUSED: The signal was inconclusive (insufficient samples): the canary is held —\nneither promoted nor rolled back — pending more data / operator action."
    },
    "v1CancelWorkflowResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1CertificateBinding": {
      "type": "object",
      "properties": {
        "bindingId": {
          "type": "string",
          "description": "Server-assigned UUID identifying this binding."
        },
        "selectorKind": {
          "type": "string",
          "description": "Certificate selector. SPIFFE_URI is preferred (matched against the URI\nSAN); DNS_SAN and SUBJECT_CN cover legacy issuance; FINGERPRINT_SHA256\npins one exact certificate (hex digest of the DER)."
        },
        "selectorValue": {
          "type": "string"
        },
        "userId": {
          "type": "string",
          "description": "The bound service-account owner. The principal's tenant/project/scopes are\nresolved from this account's CURRENT ServiceAccountGrant at request time."
        },
        "tenantId": {
          "type": "string",
          "description": "Same canonical tenant identifier type as authn User.tenant_id."
        },
        "grantRevision": {
          "type": "string",
          "format": "int64",
          "description": "The grant revision this binding was reviewed against. A grant replace\nbumps its revision; operators re-review bindings after grant changes."
        },
        "scopeSubsetJson": {
          "type": "string",
          "description": "Optional attenuation: a JSON array subset of the grant's approved scopes.\nEmpty array = the full current grant. Never a widening."
        },
        "status": {
          "type": "string",
          "description": "ACTIVE | REVOKED. Only ACTIVE bindings authenticate."
        },
        "notBefore": {
          "type": "string",
          "format": "date-time",
          "description": "Validity window (both optional; a request outside the window fails closed)."
        },
        "notAfter": {
          "type": "string",
          "format": "date-time"
        },
        "revokedAt": {
          "type": "string",
          "format": "date-time",
          "description": "Revocation metadata."
        },
        "revokeReason": {
          "type": "string"
        },
        "updatedBy": {
          "type": "string",
          "description": "Audit provenance."
        },
        "reason": {
          "type": "string"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "title": "---------------------------------------------------------------------------\nCertificateBinding — the canonical, durable, server-controlled mTLS binding\n(UDB-AUTH-007). Maps a TLS peer-certificate selector to a service-account\ngrant, so an mTLS-only request authenticates through server-side state: the\nverified certificate resolves a binding, the binding resolves the account's\nCURRENT ServiceAccountGrant, and the principal (tenant/project/scopes) is\nderived from that grant — optionally attenuated by this binding's scope\nsubset. Free-form scopes are never copied into certificate metadata, and no\ncaller header can widen the result. Unknown, expired, revoked, misbound or\nstore-unavailable certificates fail closed.\n---------------------------------------------------------------------------"
    },
    "v1ChangePasswordRequest": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "currentPassword": {
          "type": "string"
        },
        "newPassword": {
          "type": "string"
        },
        "otpId": {
          "type": "string",
          "title": "2FA OTP confirming the change"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1ChangePasswordResponse": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "changedAt": {
          "type": "string",
          "format": "date-time"
        },
        "operationId": {
          "type": "string"
        }
      }
    },
    "v1ChangeUserStatusResponse": {
      "type": "object",
      "properties": {
        "user": {
          "$ref": "#/definitions/v1User"
        }
      }
    },
    "v1ChannelStats": {
      "type": "object",
      "properties": {
        "channel": {
          "$ref": "#/definitions/v1NotificationChannel"
        },
        "sent": {
          "type": "string",
          "format": "int64"
        },
        "delivered": {
          "type": "string",
          "format": "int64"
        },
        "failed": {
          "type": "string",
          "format": "int64"
        },
        "suppressed": {
          "type": "string",
          "format": "int64"
        },
        "deliveryRate": {
          "type": "number",
          "format": "double"
        }
      }
    },
    "v1CheckAccessRequest": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        },
        "object": {
          "type": "string"
        },
        "action": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/v1AccessContext"
        },
        "principal": {
          "$ref": "#/definitions/coreAuthzServicesV1Principal"
        },
        "resource": {
          "$ref": "#/definitions/v1ResourceRef"
        },
        "purpose": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      },
      "required": [
        "userId",
        "domain",
        "object",
        "action"
      ]
    },
    "v1CheckAccessResponse": {
      "type": "object",
      "properties": {
        "allowed": {
          "type": "boolean"
        },
        "effect": {
          "$ref": "#/definitions/v1PolicyEffect"
        },
        "matchedRule": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        },
        "decision": {
          "$ref": "#/definitions/v1Decision"
        }
      }
    },
    "v1CheckQuotaRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "metric": {
          "type": "string"
        }
      }
    },
    "v1CheckQuotaResponse": {
      "type": "object",
      "properties": {
        "allowed": {
          "type": "boolean"
        },
        "used": {
          "type": "string",
          "format": "int64"
        },
        "limitValue": {
          "type": "string",
          "format": "int64"
        },
        "remaining": {
          "type": "string",
          "format": "int64"
        },
        "unlimited": {
          "type": "boolean",
          "description": "True when no enabled rule governs the metric (unenforced → allowed)."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1CloseRoomResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1CompleteStepResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1ConfigType": {
      "type": "string",
      "enum": [
        "CONFIG_TYPE_UNSPECIFIED",
        "CONFIG_TYPE_STRING",
        "CONFIG_TYPE_NUMBER",
        "CONFIG_TYPE_BOOLEAN",
        "CONFIG_TYPE_JSON"
      ],
      "default": "CONFIG_TYPE_UNSPECIFIED"
    },
    "v1ConfirmMFAEnrollmentResponse": {
      "type": "object",
      "properties": {
        "enrolled": {
          "type": "boolean"
        }
      }
    },
    "v1CreateApiKeyRequest": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "ownerType": {
          "$ref": "#/definitions/v1ApiKeyOwnerType"
        },
        "ownerId": {
          "type": "string"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "e.g. [\"resource:write\", \"project:read\"]"
        },
        "ipAllowlist": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "CIDR strings; empty = unrestricted"
        },
        "rateLimitPerMinute": {
          "type": "integer",
          "format": "int32",
          "title": "0 = use default (60)"
        },
        "rateLimitPerDay": {
          "type": "string",
          "format": "int64",
          "title": "0 = use default (10000)"
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time",
          "title": "null = never expires"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1CreateApiKeyResponse": {
      "type": "object",
      "properties": {
        "key": {
          "$ref": "#/definitions/v1ApiKey"
        },
        "plainKey": {
          "type": "string",
          "title": "Plain key returned ONCE — not stored, must be saved by caller"
        }
      }
    },
    "v1CreateCertificateBindingRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        },
        "selectorKind": {
          "type": "string",
          "description": "Allowed values: SPIFFE_URI | DNS_SAN | SUBJECT_CN | FINGERPRINT_SHA256."
        },
        "selectorValue": {
          "type": "string"
        },
        "scopeSubset": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Optional attenuation: a subset of the grant's approved scopes. Empty = the\nfull current grant. Never a widening."
        },
        "reason": {
          "type": "string"
        },
        "notBefore": {
          "type": "string",
          "format": "date-time",
          "description": "Optional server-enforced certificate validity window. Omit either bound\nfor an open-ended side; not_after must be later than not_before."
        },
        "notAfter": {
          "type": "string",
          "format": "date-time"
        }
      }
    },
    "v1CreateCertificateBindingResponse": {
      "type": "object",
      "properties": {
        "binding": {
          "$ref": "#/definitions/v1CertificateBinding"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1CreateEndpointRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected."
        },
        "url": {
          "type": "string"
        },
        "topicPattern": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "maxAttempts": {
          "type": "integer",
          "format": "int32"
        },
        "signingSecret": {
          "type": "string",
          "description": "Optional caller-supplied signing secret; when empty the broker generates one\nand returns it once in the response."
        },
        "metadataJson": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1CreateEndpointResponse": {
      "type": "object",
      "properties": {
        "endpointId": {
          "type": "string"
        },
        "signingSecret": {
          "type": "string",
          "description": "The per-endpoint signing secret — returned ONCE here, never surfaced again."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1CreateIndexRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected."
        },
        "indexName": {
          "type": "string"
        },
        "sourceMessageType": {
          "type": "string",
          "description": "Fully-qualified source entity message type to index."
        },
        "backend": {
          "type": "string",
          "description": "\"qdrant\" | \"elasticsearch\"."
        },
        "resourceName": {
          "type": "string",
          "description": "Engine resource name (Qdrant collection / ES index). Optional."
        },
        "vectorDims": {
          "type": "integer",
          "format": "int32",
          "description": "Dense-vector dimensionality (0 for full-text-only)."
        },
        "metadataJson": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1CreateIndexResponse": {
      "type": "object",
      "properties": {
        "indexId": {
          "type": "string"
        },
        "indexName": {
          "type": "string"
        },
        "tenantColumn": {
          "type": "string",
          "description": "The resolved SOURCE-table tenant column the index is scoped by."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1CreateJobRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "scheduleType": {
          "type": "string",
          "description": "\"CRON\" or \"ONE_SHOT\"."
        },
        "cronExpression": {
          "type": "string",
          "description": "Cron expression (required for CRON jobs)."
        },
        "nextFireAt": {
          "type": "string",
          "description": "RFC3339 first/only fire time (required for ONE_SHOT jobs; optional CRON seed)."
        },
        "payload": {
          "type": "string",
          "description": "Opaque JSON payload delivered with each fired event."
        },
        "targetTopic": {
          "type": "string"
        },
        "maxAttempts": {
          "type": "integer",
          "format": "int32"
        },
        "backoffSeconds": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1CreateJobResponse": {
      "type": "object",
      "properties": {
        "jobId": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1CreateNamespaceRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "namespace": {
          "type": "string"
        },
        "maxBytes": {
          "type": "string",
          "format": "int64",
          "description": "Per-tenant memory budget for this namespace; a Set that would exceed it\nfails closed with resource_exhausted. 0 = the service default budget."
        },
        "defaultTtlSeconds": {
          "type": "string",
          "format": "int64",
          "description": "Default TTL applied to a Set that does not specify one. 0 = no default."
        }
      }
    },
    "v1CreateNamespaceResponse": {
      "type": "object",
      "properties": {
        "namespace": {
          "type": "string"
        },
        "maxBytes": {
          "type": "string",
          "format": "int64"
        },
        "defaultTtlSeconds": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1CreatePipelineDefinitionRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "mediaType": {
          "type": "string"
        },
        "steps": {
          "type": "string",
          "title": "JSON"
        },
        "version": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1CreatePipelineDefinitionResponse": {
      "type": "object",
      "properties": {
        "definitionId": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1CreatePolicyDraftRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "policySetName": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "changeReason": {
          "type": "string"
        },
        "highRisk": {
          "type": "boolean"
        },
        "document": {
          "$ref": "#/definitions/v1PolicyDocument",
          "description": "Initial document. Empty + branch_from_active=true clones the active snapshot."
        },
        "branchFromActive": {
          "type": "boolean"
        }
      }
    },
    "v1CreatePolicyRuleRequest": {
      "type": "object",
      "properties": {
        "subject": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        },
        "object": {
          "type": "string"
        },
        "action": {
          "type": "string"
        },
        "effect": {
          "$ref": "#/definitions/v1PolicyEffect"
        },
        "condition": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "createdBy": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "resourceType": {
          "type": "string"
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      },
      "required": [
        "subject",
        "domain",
        "object",
        "action",
        "effect",
        "createdBy"
      ]
    },
    "v1CreatePolicyRuleResponse": {
      "type": "object",
      "properties": {
        "policy": {
          "$ref": "#/definitions/v1PolicyRule"
        }
      }
    },
    "v1CreateProviderRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "kind": {
          "$ref": "#/definitions/v1IdpKind"
        },
        "displayName": {
          "type": "string"
        },
        "issuer": {
          "type": "string"
        },
        "entityId": {
          "type": "string",
          "description": "Stable public SAML entityID. Caller-chosen format follows the SAML entityID\nURI/string rules and is scoped by tenant/provider kind."
        },
        "jwksUrl": {
          "type": "string"
        },
        "samlMetadataUrl": {
          "type": "string"
        },
        "clientIds": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "audiences": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "claimMappingJson": {
          "type": "string",
          "description": "JSON objects/strings for the mapping policies."
        },
        "groupMappingJson": {
          "type": "string"
        },
        "jitPolicyJson": {
          "type": "string"
        },
        "accountLinkingPolicy": {
          "type": "string"
        },
        "enabled": {
          "type": "boolean"
        },
        "clientSecret": {
          "type": "string",
          "description": "Optional confidential-client secret (OIDC) / SCIM bearer (write-only)."
        },
        "samlSigningKeyPem": {
          "type": "string",
          "description": "Optional SP signing key (PEM) for SAML request signing (write-only)."
        },
        "createdBy": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1CreateProviderResponse": {
      "type": "object",
      "properties": {
        "provider": {
          "$ref": "#/definitions/v1IdentityProvider"
        }
      }
    },
    "v1CreateRoleRequest": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "createdBy": {
          "type": "string"
        },
        "roleCode": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "scopeType": {
          "$ref": "#/definitions/v1RoleScopeType"
        },
        "accessSurface": {
          "type": "string"
        },
        "metadata": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      },
      "required": [
        "name",
        "createdBy"
      ]
    },
    "v1CreateRoleResponse": {
      "type": "object",
      "properties": {
        "role": {
          "$ref": "#/definitions/v1Role"
        }
      }
    },
    "v1CreateRoomRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "maxParticipants": {
          "type": "integer",
          "format": "int32"
        },
        "config": {
          "type": "string",
          "title": "JSON"
        },
        "createdBy": {
          "type": "string"
        }
      }
    },
    "v1CreateRoomResponse": {
      "type": "object",
      "properties": {
        "roomId": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1CreateServiceAccountGrantResponse": {
      "type": "object",
      "properties": {
        "grant": {
          "$ref": "#/definitions/v1ServiceAccountGrant"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1CreateSessionRequest": {
      "type": "object",
      "properties": {
        "principal": {
          "$ref": "#/definitions/coreAuthnServicesV1Principal"
        },
        "ttlSeconds": {
          "type": "string",
          "format": "int64"
        },
        "clientFingerprint": {
          "type": "string"
        }
      }
    },
    "v1CreateSessionResponse": {
      "type": "object",
      "properties": {
        "sessionId": {
          "type": "string"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1CreateTenantRequest": {
      "type": "object",
      "properties": {
        "code": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "type": {
          "type": "string"
        },
        "parentTenantId": {
          "type": "string"
        },
        "config": {
          "type": "string",
          "title": "JSON"
        },
        "branding": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1CreateTenantResponse": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1CreateTransitKeyRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        },
        "algorithm": {
          "type": "string",
          "title": "default aes256-gcm-siv"
        }
      }
    },
    "v1CreateTransitKeyResponse": {
      "type": "object",
      "properties": {
        "keyName": {
          "type": "string"
        },
        "version": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1CreateUserRequest": {
      "type": "object",
      "properties": {
        "username": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "password": {
          "type": "string",
          "title": "Min 10 chars; 1 upper, 1 lower, 1 digit, 1 special"
        },
        "tenantId": {
          "type": "string"
        },
        "fullName": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        },
        "accountKind": {
          "$ref": "#/definitions/v1AccountKind"
        },
        "projectId": {
          "type": "string"
        },
        "externalProviderId": {
          "type": "string",
          "description": "Stable public IdP provider id. Caller-chosen format is provider-specific,\nbounded to 120 characters by the user store, and scoped by tenant."
        },
        "externalSubject": {
          "type": "string"
        },
        "profileAttributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "v1CreateUserResponse": {
      "type": "object",
      "properties": {
        "user": {
          "$ref": "#/definitions/v1User"
        },
        "otpId": {
          "type": "string",
          "title": "Verification OTP sent to email"
        }
      }
    },
    "v1CutoverModelAliasRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "modelId": {
          "type": "string"
        },
        "expectedCollection": {
          "type": "string"
        }
      }
    },
    "v1CutoverModelAliasResponse": {
      "type": "object",
      "properties": {
        "cutover": {
          "type": "boolean"
        },
        "collectionAlias": {
          "type": "string"
        },
        "activeCollection": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1Decision": {
      "type": "object",
      "properties": {
        "decisionId": {
          "type": "string"
        },
        "allowed": {
          "type": "boolean"
        },
        "effect": {
          "type": "string"
        },
        "denyReason": {
          "type": "string"
        },
        "matchedPolicyIds": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "requiredScopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "policyVersion": {
          "type": "string"
        },
        "relationshipVersion": {
          "type": "string"
        },
        "cacheTtlSeconds": {
          "type": "string",
          "format": "uint64"
        },
        "auditRequired": {
          "type": "boolean"
        }
      }
    },
    "v1DecisionSource": {
      "type": "string",
      "enum": [
        "DECISION_SOURCE_UNSPECIFIED",
        "DECISION_SOURCE_ROLE_POLICY",
        "DECISION_SOURCE_DIRECT_POLICY",
        "DECISION_SOURCE_NO_MATCH"
      ],
      "default": "DECISION_SOURCE_UNSPECIFIED"
    },
    "v1DecryptRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        },
        "ciphertext": {
          "type": "string"
        }
      }
    },
    "v1DecryptResponse": {
      "type": "object",
      "properties": {
        "plaintext": {
          "type": "string"
        },
        "keyVersion": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1DeleteBackupPolicyResponse": {
      "type": "object",
      "properties": {
        "deleted": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1DeleteEndpointResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1DeleteFileResponse": {
      "type": "object",
      "properties": {
        "success": {
          "type": "boolean"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1DeleteFlagRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "environment": {
          "type": "string"
        },
        "flagKey": {
          "type": "string"
        }
      }
    },
    "v1DeleteFlagResponse": {
      "type": "object",
      "properties": {
        "deleted": {
          "type": "boolean"
        },
        "revision": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1DeleteIndexRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "indexName": {
          "type": "string"
        }
      }
    },
    "v1DeleteIndexResponse": {
      "type": "object",
      "properties": {
        "deleted": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1DeleteJobResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1DeleteMode": {
      "type": "string",
      "enum": [
        "DELETE_MODE_UNSPECIFIED",
        "DELETE_MODE_SOFT",
        "DELETE_MODE_HARD"
      ],
      "default": "DELETE_MODE_UNSPECIFIED",
      "description": "Deletion mode for DeleteFile. Additive: an absent/UNSPECIFIED mode is treated\nas SOFT so pre-existing clients (which sent only tenant_id + file_id) keep the\nhistorical soft-delete behavior.\n\n - DELETE_MODE_UNSPECIFIED: treated as SOFT\n - DELETE_MODE_SOFT: metadata tombstone + best-effort byte removal\n - DELETE_MODE_HARD: durable object-GC intent + convergent byte removal"
    },
    "v1DeleteModelRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "modelId": {
          "type": "string"
        }
      }
    },
    "v1DeleteModelResponse": {
      "type": "object",
      "properties": {
        "deleted": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1DeleteNamespaceResponse": {
      "type": "object",
      "properties": {
        "namespace": {
          "type": "string"
        },
        "keysDeleted": {
          "type": "string",
          "format": "uint64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1DeletePolicyRuleResponse": {
      "type": "object",
      "properties": {
        "deleted": {
          "type": "boolean"
        }
      }
    },
    "v1DeleteResponse": {
      "type": "object",
      "properties": {
        "deleted": {
          "type": "boolean"
        },
        "usedBytes": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1DeleteRoleResponse": {
      "type": "object",
      "properties": {
        "deleted": {
          "type": "boolean"
        }
      }
    },
    "v1DeleteSecretRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "secretPath": {
          "type": "string"
        }
      }
    },
    "v1DeleteSecretResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1DeleteSourceRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "sourceName": {
          "type": "string"
        }
      }
    },
    "v1DeleteSourceResponse": {
      "type": "object",
      "properties": {
        "deleted": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1DeleteWebAuthnCredentialResponse": {
      "type": "object",
      "properties": {
        "deleted": {
          "type": "boolean"
        }
      }
    },
    "v1DestroySecretRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "secretPath": {
          "type": "string"
        },
        "confirmationToken": {
          "type": "string",
          "description": "Required confirmation; crypto-shred is irreversible and an empty token fails\nclosed (DESTRUCTIVE)."
        }
      }
    },
    "v1DestroySecretResponse": {
      "type": "object",
      "properties": {
        "destroyedVersions": {
          "type": "integer",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1Device": {
      "type": "object",
      "properties": {
        "deviceId": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "deviceName": {
          "type": "string"
        },
        "deviceType": {
          "$ref": "#/definitions/v1DeviceType"
        },
        "fingerprintHash": {
          "type": "string",
          "description": "Keyed-HMAC digest of the device fingerprint. STORAGE_ONLY."
        },
        "lastIpMasked": {
          "type": "string",
          "description": "Source IP truncated to a network prefix (e.g. /24 or /48) — never the full\nclient IP."
        },
        "lastUserAgentHash": {
          "type": "string"
        },
        "lastSeenAt": {
          "type": "string",
          "format": "date-time"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "revokedAt": {
          "type": "string",
          "format": "date-time"
        },
        "revokedBy": {
          "type": "string"
        }
      },
      "description": "---------------------------------------------------------------------------\nDevice — a user's registered device for session/refresh binding (I1, I2.4).\n\nSessions and token families bind to a device; revoking a device blocks future\nrefresh + session validation for that device. The fingerprint is a keyed-HMAC\ndigest (STORAGE_ONLY); IP is stored masked and the user agent only as a hash.\n\nMigration order 23.\n---------------------------------------------------------------------------"
    },
    "v1DeviceType": {
      "type": "string",
      "enum": [
        "DEVICE_TYPE_UNSPECIFIED",
        "DEVICE_TYPE_WEB",
        "DEVICE_TYPE_API",
        "DEVICE_TYPE_DESKTOP",
        "DEVICE_TYPE_MOBILE",
        "DEVICE_TYPE_WORKER",
        "DEVICE_TYPE_CLI"
      ],
      "default": "DEVICE_TYPE_UNSPECIFIED"
    },
    "v1DiffPolicyDraftRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "draftId": {
          "type": "string"
        },
        "againstVersionId": {
          "type": "string",
          "description": "When set, diff against this version instead of the active snapshot."
        }
      }
    },
    "v1DiffPolicyDraftResponse": {
      "type": "object",
      "properties": {
        "entries": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PolicyDiffEntry"
          }
        },
        "diffJson": {
          "type": "string",
          "description": "Machine-readable diff document."
        }
      }
    },
    "v1DisableMfaFactorResponse": {
      "type": "object",
      "properties": {
        "disabled": {
          "type": "boolean"
        }
      }
    },
    "v1DisableProviderResponse": {
      "type": "object",
      "properties": {
        "provider": {
          "$ref": "#/definitions/v1IdentityProvider"
        }
      }
    },
    "v1DownloadFileChunk": {
      "type": "object",
      "properties": {
        "data": {
          "type": "string",
          "format": "byte",
          "description": "Raw object bytes for this frame."
        },
        "contentType": {
          "type": "string",
          "description": "First-chunk-only object metadata (absent on subsequent chunks): the file's\ncontent type, total size in bytes, and object ETag."
        },
        "totalSize": {
          "type": "string",
          "format": "int64"
        },
        "etag": {
          "type": "string"
        }
      }
    },
    "v1EffectivePermission": {
      "type": "object",
      "properties": {
        "object": {
          "type": "string",
          "description": "Canonical public permission object. Combined with action/domain/resource_type\nit forms the stable permission identity returned by ListUserPermissions."
        },
        "action": {
          "type": "string"
        },
        "viaRole": {
          "type": "string"
        },
        "resourceType": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        }
      }
    },
    "v1EgressInfo": {
      "type": "object",
      "properties": {
        "egressId": {
          "type": "string",
          "description": "Server-derived, tenant-scoped egress identifier."
        },
        "tenantId": {
          "type": "string"
        },
        "roomId": {
          "type": "string"
        },
        "trackId": {
          "type": "string",
          "description": "Set only for track egress; empty for a room composite."
        },
        "kind": {
          "type": "string",
          "description": "\"room_composite\" | \"track\"."
        },
        "status": {
          "$ref": "#/definitions/v1EgressStatus"
        },
        "destination": {
          "type": "string",
          "description": "Output destination URI (e.g. an object-store key / presigned target)."
        },
        "startedAt": {
          "type": "string",
          "format": "date-time"
        },
        "stoppedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "description": "Snapshot of one egress job, returned by ListEgress."
    },
    "v1EgressStatus": {
      "type": "string",
      "enum": [
        "EGRESS_STATUS_UNSPECIFIED",
        "EGRESS_STATUS_STARTING",
        "EGRESS_STATUS_ACTIVE",
        "EGRESS_STATUS_STOPPING",
        "EGRESS_STATUS_STOPPED",
        "EGRESS_STATUS_FAILED"
      ],
      "default": "EGRESS_STATUS_UNSPECIFIED",
      "description": "Lifecycle of one egress job.\n\n - EGRESS_STATUS_STARTING: Accepted; the backend is bringing the egress up.\n - EGRESS_STATUS_ACTIVE: Egress is running and producing output.\n - EGRESS_STATUS_STOPPING: Stop requested; the backend is tearing the egress down.\n - EGRESS_STATUS_STOPPED: Egress has stopped cleanly (terminal).\n - EGRESS_STATUS_FAILED: Egress failed to start or aborted (terminal)."
    },
    "v1EmbeddingJobStatus": {
      "type": "object",
      "properties": {
        "jobId": {
          "type": "string"
        },
        "sourceName": {
          "type": "string"
        },
        "documentId": {
          "type": "string"
        },
        "jobType": {
          "type": "string"
        },
        "mode": {
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "rowsEnumerated": {
          "type": "string",
          "format": "int64"
        },
        "chunksEmitted": {
          "type": "string",
          "format": "int64"
        },
        "vectorsStored": {
          "type": "string",
          "format": "int64"
        },
        "failed": {
          "type": "string",
          "format": "int64"
        },
        "error": {
          "type": "string"
        },
        "startedAtUnixMs": {
          "type": "string",
          "format": "int64"
        },
        "finishedAtUnixMs": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1EmbeddingModelStatus": {
      "type": "string",
      "enum": [
        "EMBEDDING_MODEL_STATUS_UNSPECIFIED",
        "EMBEDDING_MODEL_STATUS_ACTIVE",
        "EMBEDDING_MODEL_STATUS_DEPRECATED",
        "EMBEDDING_MODEL_STATUS_RETIRED"
      ],
      "default": "EMBEDDING_MODEL_STATUS_UNSPECIFIED"
    },
    "v1EmbeddingModelSummary": {
      "type": "object",
      "properties": {
        "modelId": {
          "type": "string"
        },
        "provider": {
          "type": "string"
        },
        "modelName": {
          "type": "string"
        },
        "version": {
          "type": "string"
        },
        "dimensions": {
          "type": "integer",
          "format": "int32"
        },
        "distanceMetric": {
          "type": "string"
        },
        "outputDtype": {
          "type": "string"
        },
        "taskType": {
          "type": "string"
        },
        "status": {
          "$ref": "#/definitions/v1EmbeddingModelStatus"
        },
        "vectorBackend": {
          "type": "string"
        },
        "collectionAlias": {
          "type": "string"
        },
        "activeCollection": {
          "type": "string"
        },
        "tenantState": {
          "$ref": "#/definitions/v1EmbeddingTenantState"
        }
      }
    },
    "v1EmbeddingSourceSummary": {
      "type": "object",
      "properties": {
        "sourceId": {
          "type": "string"
        },
        "sourceName": {
          "type": "string"
        },
        "sourceMessageType": {
          "type": "string"
        },
        "targetCollection": {
          "type": "string"
        },
        "modelId": {
          "type": "string"
        },
        "status": {
          "type": "string"
        }
      }
    },
    "v1EmbeddingTenantState": {
      "type": "string",
      "enum": [
        "EMBEDDING_TENANT_STATE_UNSPECIFIED",
        "EMBEDDING_TENANT_STATE_ACTIVE",
        "EMBEDDING_TENANT_STATE_INACTIVE",
        "EMBEDDING_TENANT_STATE_OFFLOADED"
      ],
      "default": "EMBEDDING_TENANT_STATE_UNSPECIFIED"
    },
    "v1EmbeddingWorkItemSummary": {
      "type": "object",
      "properties": {
        "workItemId": {
          "type": "string"
        },
        "pointId": {
          "type": "string"
        },
        "sourceName": {
          "type": "string"
        },
        "parentPk": {
          "type": "string"
        },
        "chunkSeq": {
          "type": "integer",
          "format": "int32"
        },
        "chunkHash": {
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "attemptCount": {
          "type": "integer",
          "format": "int32"
        },
        "maxAttempts": {
          "type": "integer",
          "format": "int32"
        },
        "lastError": {
          "type": "string"
        },
        "nextAttemptAtUnixMs": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1EmergencyRevokeApiKeysRequest": {
      "type": "object",
      "properties": {
        "keyPrefix": {
          "type": "string"
        },
        "ownerId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "scope": {
          "type": "string"
        },
        "createdBefore": {
          "type": "string",
          "format": "date-time"
        },
        "reason": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      },
      "description": "Emergency revoke matching keys by one or more selectors. At least one selector\nmust be set. Resolves matching records and revokes each (no prefix-only blind\nmutation): the caller's tenant/owner/admin authority is enforced per record."
    },
    "v1EmergencyRevokeApiKeysResponse": {
      "type": "object",
      "properties": {
        "revokedCount": {
          "type": "string",
          "format": "int64"
        },
        "revokedKeyIds": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "operationId": {
          "type": "string"
        }
      }
    },
    "v1EmergencyRevokeDatabaseCredentialsRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        },
        "confirmationToken": {
          "type": "string",
          "description": "Required exact value \"<tenant_id>:<resolved-project_id>\"."
        }
      }
    },
    "v1EmergencyRevokeDatabaseCredentialsResponse": {
      "type": "object",
      "properties": {
        "operationId": {
          "type": "string"
        },
        "matchedCount": {
          "type": "string",
          "format": "int64"
        },
        "revokedCount": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1EmergencyRevokeRequest": {
      "type": "object",
      "properties": {
        "signingKeyId": {
          "type": "string"
        },
        "tokenFamilyId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "principalId": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      },
      "description": "Emergency global revoke by signing key / token family / tenant / principal."
    },
    "v1EmergencyRevokeResponse": {
      "type": "object",
      "properties": {
        "familiesRevoked": {
          "type": "string",
          "format": "int64"
        },
        "sessionsRevoked": {
          "type": "string",
          "format": "int64"
        },
        "keysCompromised": {
          "type": "string",
          "format": "int64"
        },
        "operationId": {
          "type": "string"
        }
      }
    },
    "v1EncryptRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        },
        "plaintext": {
          "type": "string"
        }
      }
    },
    "v1EncryptResponse": {
      "type": "object",
      "properties": {
        "ciphertext": {
          "type": "string"
        },
        "keyVersion": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1EnrollMFAResponse": {
      "type": "object",
      "properties": {
        "totpSecret": {
          "type": "string",
          "description": "base32 raw secret (shown once, not stored in plaintext)",
          "title": "For TOTP: base32 secret + QR code URI so user can scan with authenticator app"
        },
        "totpQrUri": {
          "type": "string",
          "title": "otpauth:// URI for QR rendering"
        },
        "verifyOtpId": {
          "type": "string",
          "title": "OTP ID to confirm enrollment"
        }
      }
    },
    "v1EvaluateContext": {
      "type": "object",
      "properties": {
        "projectId": {
          "type": "string"
        },
        "environment": {
          "type": "string"
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      },
      "description": "Evaluation context. `attributes` carries the subject values the rollout hash\nkeys on (e.g. {\"user_id\": \"u-42\"}); project_id/environment select the scope."
    },
    "v1EvaluateFlagsRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keys": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "context": {
          "$ref": "#/definitions/v1EvaluateContext"
        }
      }
    },
    "v1EvaluateFlagsResponse": {
      "type": "object",
      "properties": {
        "values": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/definitions/v1FlagValue"
          },
          "description": "Resolved typed value per requested key (absent keys are omitted)."
        },
        "serverTtlSeconds": {
          "type": "string",
          "format": "int64",
          "description": "Server-authoritative cache TTL; the SDK eval cache reuses this, it is not a\nper-request env read."
        },
        "configRevision": {
          "type": "string",
          "format": "int64",
          "description": "Max per-row revision across the evaluated flags (staleness signal)."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1ExecutorPerformanceSummary": {
      "type": "object",
      "properties": {
        "summaryId": {
          "type": "string"
        },
        "summaryDate": {
          "type": "string",
          "format": "date-time"
        },
        "executorIdentity": {
          "type": "string"
        },
        "workloadKind": {
          "type": "string"
        },
        "totalDispatches": {
          "type": "string",
          "format": "int64"
        },
        "successfulResults": {
          "type": "string",
          "format": "int64"
        },
        "timeoutCount": {
          "type": "string",
          "format": "int64"
        },
        "errorCount": {
          "type": "string",
          "format": "int64"
        },
        "avgExecutionMs": {
          "type": "number",
          "format": "double"
        },
        "p99ExecutionMs": {
          "type": "number",
          "format": "double"
        },
        "avgConfidence": {
          "type": "number",
          "format": "double"
        },
        "successRate": {
          "type": "number",
          "format": "double"
        },
        "avgCapacityUtilisation": {
          "type": "number",
          "format": "double"
        },
        "recordedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "description": "Daily executor performance roll-up for project-defined workers, handlers,\ndata pipelines, or backend executors."
    },
    "v1ExplainPolicyRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "draftId": {
          "type": "string",
          "description": "Empty = explain against the active snapshot."
        },
        "candidate": {
          "$ref": "#/definitions/v1PolicyDocument"
        },
        "testCase": {
          "$ref": "#/definitions/v1SimulationCase"
        }
      }
    },
    "v1ExplainPolicyResponse": {
      "type": "object",
      "properties": {
        "decision": {
          "$ref": "#/definitions/v1Decision"
        },
        "matchedPolicyIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Ids of every policy that matched the request (post ABAC pre-filter)."
        },
        "denyReason": {
          "type": "string",
          "description": "Human-readable deny reason (empty on allow)."
        },
        "explanation": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Per-matched-policy explanation lines."
        }
      }
    },
    "v1ExternalIdentity": {
      "type": "object",
      "properties": {
        "externalIdentityId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "providerId": {
          "type": "string"
        },
        "subject": {
          "type": "string",
          "description": "Stable IdP subject (sub / NameID)."
        },
        "userId": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "emailVerified": {
          "type": "boolean"
        },
        "linkedAt": {
          "type": "string",
          "format": "date-time"
        },
        "lastLoginAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "description": "---------------------------------------------------------------------------\nExternalIdentity — Mapping from an IdP subject to a UDB user/principal.\n\nOne row per (tenant, provider, subject). Established at first login (JIT) or\nvia an explicit account-linking flow. RLS scopes rows to the current tenant.\n\nMigration order 11 — after identity_providers + authn users.\n---------------------------------------------------------------------------"
    },
    "v1FieldViolation": {
      "type": "object",
      "properties": {
        "field": {
          "type": "string"
        },
        "description": {
          "type": "string"
        }
      },
      "description": "FieldViolation describes a single field-level validation failure."
    },
    "v1File": {
      "type": "object",
      "properties": {
        "fileId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:file_id;not null\""
        },
        "tenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:tenant_id;not null\""
        },
        "projectId": {
          "type": "string",
          "description": "Optional owning project. An OPAQUE identifier, the same value the control\nplane, AuthN, policy and the DataBroker use; empty means tenant-wide.\n\nStored as bounded text rather than UUID so a registered project such as\n`billing` is accepted. A UUID's text form remains a valid opaque id, so\nexisting rows migrate losslessly via the USING cast.\n\n@inject_tag: gorm:\"column:project_id\""
        },
        "filename": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:filename;not null\""
        },
        "contentType": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:content_type\""
        },
        "sizeBytes": {
          "type": "string",
          "format": "int64",
          "title": "@inject_tag: gorm:\"column:size_bytes;not null\""
        },
        "backend": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:backend\""
        },
        "bucket": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:bucket\""
        },
        "objectKey": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:object_key;not null\""
        },
        "url": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:url\""
        },
        "cdnUrl": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:cdn_url\""
        },
        "fileType": {
          "$ref": "#/definitions/v1FileType",
          "title": "@inject_tag: gorm:\"column:file_type;serializer:proto_enum\""
        },
        "referenceId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:reference_id\""
        },
        "referenceType": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:reference_type\""
        },
        "isPublic": {
          "type": "boolean",
          "title": "@inject_tag: gorm:\"column:is_public;not null\""
        },
        "status": {
          "$ref": "#/definitions/v1FileStatus",
          "title": "@inject_tag: gorm:\"column:status;not null;serializer:proto_enum\""
        },
        "checksum": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:checksum\""
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time",
          "title": "@inject_tag: gorm:\"column:expires_at\""
        },
        "uploadedBy": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:uploaded_by\""
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedBy": {
          "type": "string"
        },
        "scanVerdict": {
          "$ref": "#/definitions/v1ScanVerdict",
          "description": "Written only by `SetScanVerdict`, which requires the privileged scanner\nscope. The default is UNSPECIFIED (\"never scanned\"), NOT pending: rows that\npredate scanning must not be mistaken for work in flight, and defaulting to\nanything else would make an upgrade look like a scanner outage.\n\n@inject_tag: gorm:\"column:scan_verdict;not null;serializer:proto_enum\"",
          "title": "── Content scanning (V050-3) ─────────────────────────────────────────────"
        },
        "scannedAt": {
          "type": "string",
          "format": "date-time",
          "title": "@inject_tag: gorm:\"column:scanned_at\""
        },
        "scannedBy": {
          "type": "string",
          "description": "Identity of the scanner that produced the verdict, taken from the verified\nprincipal rather than the request body so it cannot be spoofed.\n\n@inject_tag: gorm:\"column:scanned_by\""
        },
        "scanDetail": {
          "type": "string",
          "description": "Engine-supplied detail: signature name for INFECTED, failure reason for\nFAILED. Free text, shown to operators, never used for a control decision.\n\n@inject_tag: gorm:\"column:scan_detail\""
        }
      },
      "title": "File (object-storage metadata)"
    },
    "v1FileStatus": {
      "type": "string",
      "enum": [
        "FILE_STATUS_UNSPECIFIED",
        "FILE_STATUS_PENDING",
        "FILE_STATUS_ACTIVE",
        "FILE_STATUS_DELETED"
      ],
      "default": "FILE_STATUS_UNSPECIFIED"
    },
    "v1FileType": {
      "type": "string",
      "enum": [
        "FILE_TYPE_UNSPECIFIED",
        "FILE_TYPE_IMAGE",
        "FILE_TYPE_VIDEO",
        "FILE_TYPE_AUDIO",
        "FILE_TYPE_PDF",
        "FILE_TYPE_DOCUMENT",
        "FILE_TYPE_ARCHIVE",
        "FILE_TYPE_OTHER"
      ],
      "default": "FILE_TYPE_UNSPECIFIED"
    },
    "v1FinalizeUploadResponse": {
      "type": "object",
      "properties": {
        "file": {
          "$ref": "#/definitions/v1File"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1FinishWebAuthnAuthenticationRequest": {
      "type": "object",
      "properties": {
        "challengeId": {
          "type": "string"
        },
        "publicKeyCredentialJson": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1FinishWebAuthnAuthenticationResponse": {
      "type": "object",
      "properties": {
        "principal": {
          "$ref": "#/definitions/coreAuthnServicesV1Principal"
        },
        "sessionId": {
          "type": "string"
        },
        "accessToken": {
          "type": "string"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "credentialId": {
          "type": "string"
        }
      }
    },
    "v1FinishWebAuthnRegistrationRequest": {
      "type": "object",
      "properties": {
        "challengeId": {
          "type": "string"
        },
        "publicKeyCredentialJson": {
          "type": "string"
        },
        "label": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1FinishWebAuthnRegistrationResponse": {
      "type": "object",
      "properties": {
        "registered": {
          "type": "boolean"
        },
        "credentialId": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        }
      }
    },
    "v1FlagState": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "environment": {
          "type": "string"
        },
        "flagKey": {
          "type": "string"
        },
        "value": {
          "$ref": "#/definitions/v1FlagValue"
        },
        "enabled": {
          "type": "boolean"
        },
        "rolloutPercentage": {
          "type": "integer",
          "format": "int32"
        },
        "rolloutContextKey": {
          "type": "string"
        },
        "revision": {
          "type": "string",
          "format": "int64"
        },
        "metadataJson": {
          "type": "string"
        }
      },
      "description": "A stored flag definition returned by Get/List (no rollout applied)."
    },
    "v1FlagValue": {
      "type": "object",
      "properties": {
        "boolValue": {
          "type": "boolean"
        },
        "stringValue": {
          "type": "string"
        },
        "numberValue": {
          "type": "number",
          "format": "double"
        },
        "jsonValue": {
          "type": "string",
          "description": "Raw JSON text (object/array/scalar) for structured config."
        }
      },
      "description": "Typed flag value. The oneof carries exactly one arm; the server stores it\ncanonically as a value_type discriminator plus a serialized JSON value."
    },
    "v1ForceJwksRefreshResponse": {
      "type": "object",
      "properties": {
        "ok": {
          "type": "boolean"
        },
        "keyCount": {
          "type": "integer",
          "format": "int32"
        },
        "keyIds": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "refreshedAt": {
          "type": "string",
          "format": "date-time"
        },
        "status": {
          "type": "string"
        }
      }
    },
    "v1ForgotPasswordRequest": {
      "type": "object",
      "properties": {
        "identifier": {
          "type": "string",
          "title": "username or email"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1ForgotPasswordResponse": {
      "type": "object",
      "properties": {
        "otpId": {
          "type": "string",
          "description": "Id of the PASSWORD_RESET OTP issued (empty when the account is unknown; the\nresponse shape is uniform so it is not an account-enumeration oracle)."
        },
        "devOtpCode": {
          "type": "string",
          "description": "Dev-only echo of the plaintext PASSWORD_RESET OTP code, populated ONLY when the\nbroker runs with UDB_OTP_DEV_ECHO=1 (non-production posture). Empty in\nproduction. Lets conformance harnesses complete ResetPassword without a\ndelivery channel. bug_report.md F/Lane-2."
        }
      }
    },
    "v1FusionStrategy": {
      "type": "string",
      "enum": [
        "FUSION_STRATEGY_UNSPECIFIED",
        "FUSION_STRATEGY_RRF",
        "FUSION_STRATEGY_WEIGHTED",
        "FUSION_STRATEGY_DBSF"
      ],
      "default": "FUSION_STRATEGY_UNSPECIFIED"
    },
    "v1GenerateDataKeyRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        }
      }
    },
    "v1GenerateDataKeyResponse": {
      "type": "object",
      "properties": {
        "plaintext": {
          "type": "string",
          "description": "The plaintext data key (base64). SENSITIVE — use it to encrypt data locally\nand DO NOT persist it; store `ciphertext` instead."
        },
        "ciphertext": {
          "type": "string",
          "description": "The data key wrapped under the transit key — persist THIS; Decrypt/Rewrap later."
        },
        "keyVersion": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GenerateDatabaseCredentialsRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "roleName": {
          "type": "string"
        },
        "ttlSeconds": {
          "type": "integer",
          "format": "int32"
        },
        "projectId": {
          "type": "string",
          "description": "Must match the verified project claim/header. Empty resolves to the\ncanonical default project, never to an arbitrary catalog fallback."
        },
        "idempotencyKey": {
          "type": "string",
          "description": "Required caller-supplied replay key. Reusing it with identical authoritative\ninputs returns the original KEK-protected credential response; reusing it\nwith different inputs is an ABORTED conflict."
        }
      }
    },
    "v1GenerateDatabaseCredentialsResponse": {
      "type": "object",
      "properties": {
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "leaseId": {
          "type": "string"
        },
        "leaseTtlSeconds": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "replayed": {
          "type": "boolean"
        },
        "state": {
          "type": "string"
        }
      }
    },
    "v1GenerateRecoveryCodesResponse": {
      "type": "object",
      "properties": {
        "codes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Plaintext codes, returned exactly ONCE. Only keyed hashes are stored; any\npreviously-issued codes for the user are invalidated."
        },
        "generated": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1GetApiKeyResponse": {
      "type": "object",
      "properties": {
        "key": {
          "$ref": "#/definitions/v1ApiKey"
        }
      }
    },
    "v1GetApiKeyUsageStatsResponse": {
      "type": "object",
      "properties": {
        "stats": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ApiKeyDailyStat"
          }
        },
        "totalRequests": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1GetAssetResponse": {
      "type": "object",
      "properties": {
        "asset": {
          "$ref": "#/definitions/v1Asset"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetAuthzRevisionResponse": {
      "type": "object",
      "properties": {
        "policyRevision": {
          "type": "string",
          "format": "int64"
        },
        "relationshipRevision": {
          "type": "string",
          "format": "int64"
        },
        "contentHash": {
          "type": "string"
        },
        "changedAt": {
          "type": "string",
          "format": "date-time"
        }
      }
    },
    "v1GetBackupPolicyResponse": {
      "type": "object",
      "properties": {
        "policy": {
          "$ref": "#/definitions/v1BackupPolicyView"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GetBackupResponse": {
      "type": "object",
      "properties": {
        "backup": {
          "$ref": "#/definitions/v1BackupRunSummary"
        },
        "tables": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1BackupTableEntry"
          }
        },
        "excluded": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1BackupExcludedTable"
          }
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GetCanaryStatusResponse": {
      "type": "object",
      "properties": {
        "canary": {
          "$ref": "#/definitions/v1PolicyCanary"
        },
        "promoteEligible": {
          "type": "boolean",
          "description": "True when the success window has elapsed and the canary is ACTIVE within\nthreshold — i.e. PromoteCanary would succeed right now."
        },
        "windowRemainingSecs": {
          "type": "string",
          "format": "int64",
          "description": "Seconds remaining in the success window (0 once elapsed)."
        }
      }
    },
    "v1GetDeliveryStatsResponse": {
      "type": "object",
      "properties": {
        "totalSent": {
          "type": "string",
          "format": "int64"
        },
        "totalDelivered": {
          "type": "string",
          "format": "int64"
        },
        "totalFailed": {
          "type": "string",
          "format": "int64"
        },
        "overallDeliveryRate": {
          "type": "number",
          "format": "double"
        },
        "byChannel": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ChannelStats"
          }
        }
      }
    },
    "v1GetDownloadUrlResponse": {
      "type": "object",
      "properties": {
        "downloadUrl": {
          "type": "string"
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetEmbeddingJobStatusResponse": {
      "type": "object",
      "properties": {
        "job": {
          "$ref": "#/definitions/v1EmbeddingJobStatus"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GetEndpointResponse": {
      "type": "object",
      "properties": {
        "endpoint": {
          "$ref": "#/definitions/v1WebhookEndpoint"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GetExecutorPerformanceResponse": {
      "type": "object",
      "properties": {
        "summaries": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ExecutorPerformanceSummary"
          }
        }
      }
    },
    "v1GetFileResponse": {
      "type": "object",
      "properties": {
        "file": {
          "$ref": "#/definitions/v1File"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetFlagResponse": {
      "type": "object",
      "properties": {
        "found": {
          "type": "boolean"
        },
        "flag": {
          "$ref": "#/definitions/v1FlagState"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GetJobResponse": {
      "type": "object",
      "properties": {
        "job": {
          "$ref": "#/definitions/v1ScheduledJob"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GetJwksResponse": {
      "type": "object",
      "properties": {
        "jwksJson": {
          "type": "string",
          "title": "RFC 7517 JWK Set document for verifying UDB-issued JWTs"
        }
      }
    },
    "v1GetLockResponse": {
      "type": "object",
      "properties": {
        "lock": {
          "$ref": "#/definitions/lockServicesV1Lock",
          "description": "Populated only when found=true."
        },
        "found": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetMfaPolicyResponse": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "requireMfa": {
          "type": "boolean"
        }
      }
    },
    "v1GetNamespaceStatsResponse": {
      "type": "object",
      "properties": {
        "namespace": {
          "type": "string"
        },
        "usedBytes": {
          "type": "string",
          "format": "int64"
        },
        "maxBytes": {
          "type": "string",
          "format": "int64"
        },
        "itemCount": {
          "type": "string",
          "format": "uint64"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetNotificationResponse": {
      "type": "object",
      "properties": {
        "log": {
          "$ref": "#/definitions/v1NotificationLog"
        }
      }
    },
    "v1GetPeerResponse": {
      "type": "object",
      "properties": {
        "peer": {
          "$ref": "#/definitions/v1Peer"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetPipelineDefinitionResponse": {
      "type": "object",
      "properties": {
        "definition": {
          "$ref": "#/definitions/v1PipelineDefinition"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetPipelineResponse": {
      "type": "object",
      "properties": {
        "instance": {
          "$ref": "#/definitions/v1PipelineInstance"
        },
        "steps": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PipelineStep"
          }
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetPipelineSummaryResponse": {
      "type": "object",
      "properties": {
        "snapshots": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PipelineMetricSnapshot"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1GetPolicyRuleResponse": {
      "type": "object",
      "properties": {
        "policy": {
          "$ref": "#/definitions/v1PolicyRule"
        }
      }
    },
    "v1GetPreferenceResponse": {
      "type": "object",
      "properties": {
        "preference": {
          "$ref": "#/definitions/v1NotificationPreference"
        }
      }
    },
    "v1GetProviderResponse": {
      "type": "object",
      "properties": {
        "provider": {
          "$ref": "#/definitions/v1IdentityProvider"
        }
      }
    },
    "v1GetQuotaResponse": {
      "type": "object",
      "properties": {
        "found": {
          "type": "boolean"
        },
        "quota": {
          "$ref": "#/definitions/v1QuotaState"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GetReconciliationAnalyticsResponse": {
      "type": "object",
      "properties": {
        "summaries": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ReconciliationAnalyticsSummary"
          }
        },
        "overallResolutionRate": {
          "type": "number",
          "format": "double"
        },
        "avgReconciliationMs": {
          "type": "number",
          "format": "double"
        }
      }
    },
    "v1GetResourcesResponse": {
      "type": "object",
      "properties": {
        "resources": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Resource"
          }
        },
        "versionInfo": {
          "type": "string",
          "description": "Aggregate content version for the returned set (the version-of-the-world)."
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1GetResponse": {
      "type": "object",
      "properties": {
        "found": {
          "type": "boolean"
        },
        "value": {
          "type": "string",
          "format": "byte"
        },
        "ttlRemainingSeconds": {
          "type": "string",
          "format": "int64"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetRoleResponse": {
      "type": "object",
      "properties": {
        "role": {
          "$ref": "#/definitions/v1Role"
        }
      }
    },
    "v1GetRoomResponse": {
      "type": "object",
      "properties": {
        "room": {
          "$ref": "#/definitions/v1Room"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetSecretResponse": {
      "type": "object",
      "properties": {
        "secretPath": {
          "type": "string"
        },
        "version": {
          "type": "integer",
          "format": "int32"
        },
        "secretValue": {
          "type": "string"
        },
        "metadataJson": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GetServiceAccountGrantResponse": {
      "type": "object",
      "properties": {
        "grant": {
          "$ref": "#/definitions/v1ServiceAccountGrant"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetSessionResponse": {
      "type": "object",
      "properties": {
        "session": {
          "$ref": "#/definitions/v1Session"
        }
      }
    },
    "v1GetSlaComplianceResponse": {
      "type": "object",
      "properties": {
        "entries": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1SlaComplianceEntry"
          }
        },
        "overallP99ComplianceRate": {
          "type": "number",
          "format": "double"
        },
        "overallErrorRateComplianceRate": {
          "type": "number",
          "format": "double"
        }
      }
    },
    "v1GetTemplateResponse": {
      "type": "object",
      "properties": {
        "template": {
          "$ref": "#/definitions/v1NotificationTemplate"
        }
      }
    },
    "v1GetTenantConfigResponse": {
      "type": "object",
      "properties": {
        "configs": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1TenantConfig"
          }
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetTenantResponse": {
      "type": "object",
      "properties": {
        "tenant": {
          "$ref": "#/definitions/v1Tenant"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1GetThroughputResponse": {
      "type": "object",
      "properties": {
        "avgRps": {
          "type": "number",
          "format": "double"
        },
        "peakRps": {
          "type": "number",
          "format": "double"
        },
        "totalRequests": {
          "type": "string",
          "format": "int64"
        },
        "overallSuccessRate": {
          "type": "number",
          "format": "double"
        }
      }
    },
    "v1GetTransitPublicKeyRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        }
      }
    },
    "v1GetTransitPublicKeyResponse": {
      "type": "object",
      "properties": {
        "keyName": {
          "type": "string"
        },
        "algorithm": {
          "type": "string"
        },
        "publicKeys": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1TransitPublicKey"
          }
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GetUserResponse": {
      "type": "object",
      "properties": {
        "user": {
          "$ref": "#/definitions/v1User"
        }
      }
    },
    "v1GetWorkflowResponse": {
      "type": "object",
      "properties": {
        "workflow": {
          "$ref": "#/definitions/v1WorkflowInstance"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1GovernanceActor": {
      "type": "object",
      "properties": {
        "subject": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "breakGlass": {
          "type": "boolean",
          "description": "Break-glass: when set, a short-TTL emergency bypass with a recorded reason."
        },
        "breakGlassReason": {
          "type": "string"
        },
        "breakGlassExpiresAtUnix": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "The governance actor whose authorization is checked under\n`native.authz.governance` for every governance mutation. The AUTHORITATIVE\ncaller identity and scopes come from the verified claim (the bearer token),\nNOT from this message. The `subject` / `scopes` / `roles` fields here are\naccepted ONLY as cross-tenant-admin / impersonation TARGET hints; they never\ngrant capability and are ignored for authorizing the caller. The\n`break_glass*` fields below are the only authoritative body fields on this\nmessage (a short-TTL emergency bypass with a recorded reason)."
    },
    "v1HmacRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        },
        "input": {
          "type": "string"
        }
      }
    },
    "v1HmacResponse": {
      "type": "object",
      "properties": {
        "hmac": {
          "type": "string"
        },
        "keyVersion": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1IceServer": {
      "type": "object",
      "properties": {
        "urls": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "username": {
          "type": "string"
        },
        "credential": {
          "type": "string"
        }
      }
    },
    "v1IdentityProvider": {
      "type": "object",
      "properties": {
        "providerId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "kind": {
          "$ref": "#/definitions/v1IdpKind"
        },
        "displayName": {
          "type": "string"
        },
        "issuer": {
          "type": "string",
          "description": "OIDC issuer URL."
        },
        "entityId": {
          "type": "string",
          "description": "SAML entity id (a.k.a. IdP entityID)."
        },
        "jwksUrl": {
          "type": "string"
        },
        "samlMetadataUrl": {
          "type": "string"
        },
        "clientIdsJson": {
          "type": "string",
          "description": "JSON array of accepted OIDC client_ids for this provider."
        },
        "audiencesJson": {
          "type": "string",
          "description": "JSON array of accepted token audiences."
        },
        "claimMappingJson": {
          "type": "string",
          "description": "claim_mapping: maps IdP claims → UDB principal fields (subject, email, ...)."
        },
        "groupMappingJson": {
          "type": "string",
          "description": "group_mapping: maps IdP groups → UDB roles (the ONLY way groups grant roles)."
        },
        "jitPolicyJson": {
          "type": "string",
          "description": "jit_policy: JIT provisioning rules (allowed_domains, require_verified_email,\ndefault_project, default_roles, ...)."
        },
        "accountLinkingPolicy": {
          "type": "string",
          "description": "account_linking_policy: how an external identity is linked to a UDB user\nwhen the email already exists (e.g. \"explicit\", \"auto_verified\", \"deny\")."
        },
        "enabled": {
          "type": "boolean"
        },
        "clientSecret": {
          "type": "string",
          "description": "Operator-supplied client secret (OIDC confidential clients / SCIM bearer).\nStorage-only + encrypted: never returned on read, redacted in logs/events."
        },
        "samlSigningKeyPem": {
          "type": "string",
          "description": "SP-side private key (PEM) for SAML AuthnRequest signing. Storage-only."
        },
        "samlIdpCertsJson": {
          "type": "string",
          "description": "IdP signing certificate(s) (PEM, JSON array) imported from SAML metadata —\nused to verify assertion signatures. Public material, not secret."
        },
        "samlSsoUrl": {
          "type": "string",
          "description": "SAML SingleSignOnService location (redirect/POST binding URL)."
        },
        "health": {
          "$ref": "#/definitions/v1ProviderHealth",
          "title": "── Provider health (J2.1) ────────────────────────────────────────────────"
        },
        "lastJwksRefreshAt": {
          "type": "string",
          "format": "date-time"
        },
        "lastJwksRefreshStatus": {
          "type": "string"
        },
        "createdBy": {
          "type": "string",
          "title": "── Audit (J4: changes are audited + rollbackable) ────────────────────────"
        },
        "updatedBy": {
          "type": "string"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "description": "---------------------------------------------------------------------------\nIdentityProvider — Tenant-scoped SSO/identity provider configuration.\n\nOne row per (tenant, provider). The kind determines which fields are\nmeaningful: OIDC uses issuer/jwks_url/client_ids/audiences; SAML uses\nentity_id/saml_metadata_url. claim/group/jit mappings are JSON-encoded\npolicies consumed by the IdP runtime. RLS scopes rows to the current tenant.\n\nMigration order 10 — after the authn tables so external identities can FK to\nusers; before SCIM directory state.\n---------------------------------------------------------------------------"
    },
    "v1IdpKind": {
      "type": "string",
      "enum": [
        "IDP_KIND_UNSPECIFIED",
        "IDP_KIND_NATIVE",
        "IDP_KIND_OIDC",
        "IDP_KIND_SAML",
        "IDP_KIND_LDAP",
        "IDP_KIND_CUSTOM_JWT",
        "IDP_KIND_EXTERNAL_SESSION"
      ],
      "default": "IDP_KIND_UNSPECIFIED",
      "description": "Kind of identity provider configured for a tenant.\n\n - IDP_KIND_NATIVE: UDB native password/MFA\n - IDP_KIND_OIDC: OpenID Connect (discovery + JWKS)\n - IDP_KIND_SAML: SAML 2.0 web SSO\n - IDP_KIND_LDAP: LDAP / Active Directory bind\n - IDP_KIND_CUSTOM_JWT: Bring-your-own signed JWT (jwks_url + claims)\n - IDP_KIND_EXTERNAL_SESSION: Upstream session handed off to UDB"
    },
    "v1ImportSamlMetadataResponse": {
      "type": "object",
      "properties": {
        "entityId": {
          "type": "string"
        },
        "ssoUrl": {
          "type": "string"
        },
        "certCount": {
          "type": "integer",
          "format": "int32"
        },
        "provider": {
          "$ref": "#/definitions/v1IdentityProvider"
        }
      }
    },
    "v1IngestDocumentBatchRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "documents": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1IngestDocumentRequest"
          }
        }
      }
    },
    "v1IngestDocumentBatchResponse": {
      "type": "object",
      "properties": {
        "documents": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1IngestDocumentResponse"
          }
        },
        "accepted": {
          "type": "integer",
          "format": "int32"
        },
        "failed": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1IngestDocumentRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "externalId": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "rawText": {
          "type": "string"
        },
        "storageObjectRef": {
          "type": "string"
        },
        "contentType": {
          "type": "string"
        },
        "docVersion": {
          "type": "string"
        },
        "modelId": {
          "type": "string"
        },
        "metadataJson": {
          "type": "string"
        }
      }
    },
    "v1IngestDocumentResponse": {
      "type": "object",
      "properties": {
        "documentId": {
          "type": "string"
        },
        "jobId": {
          "type": "string"
        },
        "accepted": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "sourceName": {
          "type": "string"
        }
      }
    },
    "v1IntrospectTokenRequest": {
      "type": "object",
      "properties": {
        "token": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1IntrospectTokenResponse": {
      "type": "object",
      "properties": {
        "active": {
          "type": "boolean"
        },
        "subject": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "serviceIdentity": {
          "type": "string"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "keyId": {
          "type": "string",
          "description": "Real introspection metadata (Phase 3 / I2.1).\n\nkid of the signing key that produced the token"
        },
        "tokenType": {
          "type": "string",
          "title": "jwt_access | jwt_refresh | session | api_key"
        },
        "sessionId": {
          "type": "string",
          "title": "issuing session handle, when present"
        },
        "revocationReason": {
          "type": "string",
          "title": "populated when active=false due to revocation"
        }
      }
    },
    "v1InvalidatePolicyBundlesRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        }
      }
    },
    "v1InvalidatePolicyBundlesResponse": {
      "type": "object",
      "properties": {
        "ok": {
          "type": "boolean"
        },
        "policyRevision": {
          "type": "string",
          "format": "int64"
        },
        "relationshipRevision": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1IssueCredentialsRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "roomId": {
          "type": "string"
        },
        "peerId": {
          "type": "string"
        },
        "ttlSeconds": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1IssueCredentialsResponse": {
      "type": "object",
      "properties": {
        "iceServers": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1IceServer"
          }
        },
        "username": {
          "type": "string"
        },
        "credential": {
          "type": "string"
        },
        "ttlSeconds": {
          "type": "integer",
          "format": "int32"
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "allowedAction": {
          "type": "string",
          "description": "The action bound into the signed TURN REST username. Credentials issued by\nthis RPC authorize media relay only, not arbitrary WebRTC control-plane RPCs."
        }
      }
    },
    "v1IssueMfaChallengeRequest": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "factorKind": {
          "$ref": "#/definitions/v1AuthFactorKind"
        },
        "purpose": {
          "$ref": "#/definitions/v1MfaChallengePurpose"
        },
        "deviceFingerprint": {
          "type": "string"
        },
        "ipAddress": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1IssueMfaChallengeResponse": {
      "type": "object",
      "properties": {
        "challengeId": {
          "type": "string"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "factorKind": {
          "$ref": "#/definitions/v1AuthFactorKind"
        }
      }
    },
    "v1JobStatus": {
      "type": "string",
      "enum": [
        "JOB_STATUS_UNSPECIFIED",
        "JOB_STATUS_ACTIVE",
        "JOB_STATUS_PAUSED",
        "JOB_STATUS_COMPLETED",
        "JOB_STATUS_DEAD"
      ],
      "default": "JOB_STATUS_UNSPECIFIED",
      "description": "Lifecycle status of a scheduled job. Only ACTIVE jobs are claimed by the tick.\n\n - JOB_STATUS_ACTIVE: Eligible to fire when next_fire_at is due.\n - JOB_STATUS_PAUSED: Paused by an operator; never claimed by the tick until resumed.\n - JOB_STATUS_COMPLETED: One-shot job that already fired; terminal.\n - JOB_STATUS_DEAD: Exceeded max_attempts; routed to the dead-letter topic and never re-fired."
    },
    "v1JoinRoomResponse": {
      "type": "object",
      "properties": {
        "peer": {
          "$ref": "#/definitions/v1Peer"
        },
        "existingPeers": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Peer"
          }
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1LeaveRoomResponse": {
      "type": "object",
      "properties": {
        "success": {
          "type": "boolean"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1LinkIdentityRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "providerId": {
          "type": "string"
        },
        "subject": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "emailVerified": {
          "type": "boolean"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      },
      "description": "Explicitly link an IdP subject to an existing UDB user."
    },
    "v1LinkIdentityResponse": {
      "type": "object",
      "properties": {
        "identity": {
          "$ref": "#/definitions/v1ExternalIdentity"
        }
      }
    },
    "v1LintAuthzPoliciesRequest": {
      "type": "object"
    },
    "v1LintAuthzPoliciesResponse": {
      "type": "object",
      "properties": {
        "findings": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "v1ListAccessDecisionAuditsResponse": {
      "type": "object",
      "properties": {
        "audits": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1AccessDecisionAudit"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListApiKeysResponse": {
      "type": "object",
      "properties": {
        "keys": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ApiKey"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListAssetsResponse": {
      "type": "object",
      "properties": {
        "assets": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Asset"
          }
        },
        "totalCount": {
          "type": "integer",
          "format": "int32"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more assets are available."
        }
      }
    },
    "v1ListBackupPoliciesResponse": {
      "type": "object",
      "properties": {
        "policies": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1BackupPolicyView"
          }
        },
        "nextPageToken": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1ListBackupsResponse": {
      "type": "object",
      "properties": {
        "backups": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1BackupRunSummary"
          }
        },
        "nextPageToken": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1ListCertificateBindingsResponse": {
      "type": "object",
      "properties": {
        "bindings": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1CertificateBinding"
          }
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque pagination token; empty when this is the last page."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1ListDeliveriesResponse": {
      "type": "object",
      "properties": {
        "deliveries": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1WebhookDelivery"
          }
        },
        "totalCount": {
          "type": "integer",
          "format": "int32"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more deliveries are available."
        }
      }
    },
    "v1ListDevicesResponse": {
      "type": "object",
      "properties": {
        "devices": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Device"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListEgressResponse": {
      "type": "object",
      "properties": {
        "egresses": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1EgressInfo"
          }
        },
        "totalCount": {
          "type": "integer",
          "format": "int32"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "description": "Error information if operation failed."
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more egress jobs are available."
        }
      }
    },
    "v1ListEmbeddingWorkItemsResponse": {
      "type": "object",
      "properties": {
        "workItems": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1EmbeddingWorkItemSummary"
          }
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque pagination token; empty when this is the last page."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1ListEndpointsResponse": {
      "type": "object",
      "properties": {
        "endpoints": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1WebhookEndpoint"
          }
        },
        "totalCount": {
          "type": "integer",
          "format": "int32"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more endpoints are available."
        }
      }
    },
    "v1ListExternalIdentitiesResponse": {
      "type": "object",
      "properties": {
        "identities": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ExternalIdentity"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListFilesResponse": {
      "type": "object",
      "properties": {
        "files": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1File"
          }
        },
        "totalCount": {
          "type": "integer",
          "format": "int32"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more files are available."
        }
      }
    },
    "v1ListFlagsResponse": {
      "type": "object",
      "properties": {
        "flags": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1FlagState"
          }
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more flags are available."
        }
      }
    },
    "v1ListIndexesResponse": {
      "type": "object",
      "properties": {
        "indexes": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1SearchIndexSummary"
          }
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more indexes are available."
        }
      }
    },
    "v1ListJobsResponse": {
      "type": "object",
      "properties": {
        "jobs": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ScheduledJob"
          }
        },
        "totalCount": {
          "type": "integer",
          "format": "int32"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more jobs are available."
        }
      }
    },
    "v1ListLocksResponse": {
      "type": "object",
      "properties": {
        "locks": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/lockServicesV1Lock"
          }
        },
        "nextPageToken": {
          "type": "string",
          "description": "Empty when the last page has been returned."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1ListMfaFactorsResponse": {
      "type": "object",
      "properties": {
        "factors": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1MfaFactorSummary"
          }
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more factors are available."
        }
      }
    },
    "v1ListModelsResponse": {
      "type": "object",
      "properties": {
        "models": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1EmbeddingModelSummary"
          }
        },
        "nextPageToken": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1ListNodeStatesResponse": {
      "type": "object",
      "properties": {
        "nodeStates": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1NodeAckState"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListNotificationsResponse": {
      "type": "object",
      "properties": {
        "logs": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1NotificationLog"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListPeersResponse": {
      "type": "object",
      "properties": {
        "peers": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Peer"
          }
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more peers are available."
        }
      }
    },
    "v1ListPolicyRulesResponse": {
      "type": "object",
      "properties": {
        "policies": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PolicyRule"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListPolicyVersionsResponse": {
      "type": "object",
      "properties": {
        "versions": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PolicyVersion"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListPreferencesResponse": {
      "type": "object",
      "properties": {
        "preferences": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1NotificationPreference"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListProvidersResponse": {
      "type": "object",
      "properties": {
        "providers": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1IdentityProvider"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListQuotasResponse": {
      "type": "object",
      "properties": {
        "quotas": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1QuotaState"
          }
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more quotas are available."
        }
      }
    },
    "v1ListRolesResponse": {
      "type": "object",
      "properties": {
        "roles": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Role"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListRoomsResponse": {
      "type": "object",
      "properties": {
        "rooms": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Room"
          }
        },
        "totalCount": {
          "type": "integer",
          "format": "int32"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more rooms are available."
        }
      }
    },
    "v1ListSecretsResponse": {
      "type": "object",
      "properties": {
        "secrets": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1SecretSummary"
          }
        },
        "totalCount": {
          "type": "integer",
          "format": "int32"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more secret paths are available."
        }
      }
    },
    "v1ListServiceAccountGrantsResponse": {
      "type": "object",
      "properties": {
        "grants": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ServiceAccountGrant"
          }
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque pagination token; empty when this is the last page."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1ListSessionsResponse": {
      "type": "object",
      "properties": {
        "sessions": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Session"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListSourcesResponse": {
      "type": "object",
      "properties": {
        "sources": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1EmbeddingSourceSummary"
          }
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more sources are available."
        }
      }
    },
    "v1ListTemplatesResponse": {
      "type": "object",
      "properties": {
        "templates": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1NotificationTemplate"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListTenantsResponse": {
      "type": "object",
      "properties": {
        "tenants": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Tenant"
          }
        },
        "totalCount": {
          "type": "integer",
          "format": "int32"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more tenants are available."
        }
      }
    },
    "v1ListTracksResponse": {
      "type": "object",
      "properties": {
        "tracks": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Track"
          }
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more tracks are available."
        }
      }
    },
    "v1ListUserPermissionsResponse": {
      "type": "object",
      "properties": {
        "permissions": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1EffectivePermission"
          }
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more permissions are available."
        }
      }
    },
    "v1ListUserRolesResponse": {
      "type": "object",
      "properties": {
        "userRoles": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1UserRole"
          }
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more user roles are available."
        }
      }
    },
    "v1ListUsersResponse": {
      "type": "object",
      "properties": {
        "users": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1User"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ListWebAuthnCredentialsResponse": {
      "type": "object",
      "properties": {
        "credentials": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1WebAuthnCredentialSummary"
          }
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more credentials are available."
        }
      }
    },
    "v1ListWorkflowsResponse": {
      "type": "object",
      "properties": {
        "workflows": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1WorkflowInstance"
          }
        },
        "totalCount": {
          "type": "integer",
          "format": "int32"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more workflows are available."
        }
      }
    },
    "v1LiveQueryChange": {
      "type": "object",
      "properties": {
        "op": {
          "$ref": "#/definitions/v1LiveQueryChangeOp"
        },
        "rowJson": {
          "type": "string",
          "description": "The changed row encoded as a JSON object string."
        },
        "eventId": {
          "type": "string",
          "description": "Source CDC event id (for client-side de-duplication / resume)."
        }
      }
    },
    "v1LiveQueryChangeOp": {
      "type": "string",
      "enum": [
        "LIVE_QUERY_CHANGE_OP_UNSPECIFIED",
        "LIVE_QUERY_CHANGE_OP_INSERT",
        "LIVE_QUERY_CHANGE_OP_UPDATE",
        "LIVE_QUERY_CHANGE_OP_DELETE"
      ],
      "default": "LIVE_QUERY_CHANGE_OP_UNSPECIFIED",
      "description": "The kind of change a delta represents."
    },
    "v1LiveQueryComparison": {
      "type": "string",
      "enum": [
        "LIVE_QUERY_COMPARISON_UNSPECIFIED",
        "LIVE_QUERY_COMPARISON_EQ",
        "LIVE_QUERY_COMPARISON_NE",
        "LIVE_QUERY_COMPARISON_LT",
        "LIVE_QUERY_COMPARISON_LE",
        "LIVE_QUERY_COMPARISON_GT",
        "LIVE_QUERY_COMPARISON_GE"
      ],
      "default": "LIVE_QUERY_COMPARISON_UNSPECIFIED",
      "description": "Comparison operator for a live-query predicate. Maps 1:1 onto the neutral IR\n`ComparisonOp`; only the scalar relational operators are exposed (the live\nsingle-row evaluator and the mediated snapshot read share the same set)."
    },
    "v1LiveQueryPredicate": {
      "type": "object",
      "properties": {
        "field": {
          "type": "string",
          "description": "Proto logical field name on the source entity (dotted paths allowed)."
        },
        "op": {
          "$ref": "#/definitions/v1LiveQueryComparison"
        },
        "value": {
          "type": "string"
        }
      },
      "description": "One AND-ed predicate of the subscription filter. The value is carried as a\nstring and compared as a number when both sides parse numerically, else as a\nstring — keeping the wire contract simple while staying IR-expressible."
    },
    "v1LiveQuerySnapshot": {
      "type": "object",
      "properties": {
        "rowsJson": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Each matching row encoded as a JSON object string."
        },
        "rowCount": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1LoginRequest": {
      "type": "object",
      "properties": {
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "deviceType": {
          "$ref": "#/definitions/v1DeviceType"
        },
        "deviceName": {
          "type": "string",
          "title": "human-readable"
        },
        "ipAddress": {
          "type": "string",
          "title": "forwarded by gateway"
        },
        "userAgent": {
          "type": "string"
        },
        "deviceId": {
          "type": "string",
          "title": "client device fingerprint (optional; for JWT device binding)"
        },
        "mfaOtpId": {
          "type": "string",
          "description": "MFA step-2 fields — set on the second Login call after receiving mfa_required=true.\nThe password (first factor) is ALWAYS verified; these only supply the second\nfactor and never substitute for it. Provide totp_code for an authenticator app,\nor mfa_otp_id plus the one-time code (carried in totp_code) for a LOGIN_2FA\nemail/SMS code previously issued to this same user.\n\nid of a LOGIN_2FA OTP issued to this user (email/SMS second factor)"
        },
        "totpCode": {
          "type": "string",
          "title": "6-digit TOTP code, or the one-time code when mfa_otp_id is set"
        },
        "tenantHint": {
          "type": "string"
        },
        "projectHint": {
          "type": "string"
        },
        "accessSurface": {
          "type": "string"
        },
        "recoveryCode": {
          "type": "string",
          "title": "single-use MFA recovery/backup code (alternative second factor)"
        }
      }
    },
    "v1LoginResponse": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "sessionId": {
          "type": "string"
        },
        "accessToken": {
          "type": "string",
          "title": "JWT fields (only when device_type != WEB)"
        },
        "refreshToken": {
          "type": "string"
        },
        "accessTokenExpiresIn": {
          "type": "integer",
          "format": "int32",
          "title": "seconds"
        },
        "sessionToken": {
          "type": "string",
          "title": "Server-side session fields (only when device_type = WEB)\nsession_token returned to gateway which sets it as HttpOnly cookie"
        },
        "csrfToken": {
          "type": "string",
          "title": "injected into a readable cookie"
        },
        "mfaRequired": {
          "type": "boolean",
          "title": "true = client must re-call Login with password + second factor"
        },
        "mfaOtpId": {
          "type": "string",
          "title": "reserved for a future server-issued MFA challenge id (currently empty)"
        },
        "refreshTokenExpiresIn": {
          "type": "integer",
          "format": "int32",
          "description": "Absolute lifetime (seconds) of the rotating refresh token (field 4). The\nrefresh token is a token-family credential (rt_<family>.<jti>), rotated on\nevery RefreshToken call; reuse of a superseded value revokes the family."
        }
      }
    },
    "v1LogoutRequest": {
      "type": "object",
      "properties": {
        "sessionId": {
          "type": "string"
        },
        "allSessions": {
          "type": "boolean",
          "title": "if true, revoke all sessions for this user"
        },
        "revokeReason": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1LogoutResponse": {
      "type": "object",
      "properties": {
        "sessionsRevoked": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1MfaChallengePurpose": {
      "type": "string",
      "enum": [
        "MFA_CHALLENGE_PURPOSE_UNSPECIFIED",
        "MFA_CHALLENGE_PURPOSE_LOGIN_STEP_UP",
        "MFA_CHALLENGE_PURPOSE_SENSITIVE_OPERATION",
        "MFA_CHALLENGE_PURPOSE_ENROLLMENT",
        "MFA_CHALLENGE_PURPOSE_RECOVERY"
      ],
      "default": "MFA_CHALLENGE_PURPOSE_UNSPECIFIED",
      "description": "Purpose a step-up MFA challenge is issued for. Binds the challenge record to\nthe operation that requested it so a challenge minted for login cannot be\nreplayed to authorize a sensitive mutation."
    },
    "v1MfaFactorSummary": {
      "type": "object",
      "properties": {
        "factorKind": {
          "$ref": "#/definitions/v1AuthFactorKind",
          "description": "Canonical public identity of this MFA factor within the owning user."
        },
        "enabled": {
          "type": "boolean"
        },
        "label": {
          "type": "string"
        }
      }
    },
    "v1MigrateLegacyPoliciesRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "apply": {
          "type": "boolean",
          "description": "When true, write a governed draft; when false, only produce the report."
        },
        "policySetName": {
          "type": "string"
        }
      }
    },
    "v1MigrateLegacyPoliciesResponse": {
      "type": "object",
      "properties": {
        "draft": {
          "$ref": "#/definitions/v1PolicyDraft",
          "description": "Draft created when apply=true (empty otherwise)."
        },
        "diff": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PolicyDiffEntry"
          },
          "description": "Migration diff report (added/removed/changed)."
        },
        "simulation": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1SimulationResult"
          },
          "description": "Per-sample-case simulation report proving parity."
        },
        "reportJson": {
          "type": "string"
        }
      }
    },
    "v1MmrConfig": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean"
        },
        "lambda": {
          "type": "number",
          "format": "double"
        }
      }
    },
    "v1MuteTrackResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1NativeAccessGrant": {
      "type": "object",
      "properties": {
        "dsn": {
          "type": "string",
          "description": "Connection string scoped to the restricted role. Secret — redact in logs."
        },
        "role": {
          "type": "string",
          "description": "Restricted database role the DSN authenticates as."
        },
        "backend": {
          "type": "string"
        },
        "database": {
          "type": "string"
        },
        "schema": {
          "type": "string"
        },
        "sessionVariables": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "`app.current_*` session variables the caller must apply per transaction\n(`SET LOCAL`) so broker RLS policies see the same context the broker did."
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "ttlSeconds": {
          "type": "string",
          "format": "uint64"
        }
      },
      "description": "The minted native-access contract. Present only when the embedded\n`Decision` allowed the request."
    },
    "v1NativeAccessRequest": {
      "type": "object",
      "properties": {
        "principal": {
          "$ref": "#/definitions/coreAuthzServicesV1Principal"
        },
        "sessionId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "resource": {
          "$ref": "#/definitions/v1ResourceRef"
        },
        "action": {
          "type": "string"
        },
        "purpose": {
          "type": "string"
        },
        "requestedScopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "context": {
          "$ref": "#/definitions/v1AccessContext"
        },
        "backend": {
          "type": "string",
          "description": "Requested backend (default \"postgres\"); other backends are reserved."
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      },
      "description": "`GetNativeAccess` runs the same `Authorize` decision and, when allowed,\nmints a short-lived contract for the caller to talk to the backend\ndirectly: a restricted role, a scoped DSN, and the exact set of\n`app.current_*` session variables the SDK must `SET LOCAL` so the\nbroker-generated RLS policies still apply. UDB stays the source of the\nauthorization decision; the native grant only carries it forward.",
      "title": "── Stage 2: native database fast-path access ──────────────────────────────"
    },
    "v1NativeAccessResponse": {
      "type": "object",
      "properties": {
        "decision": {
          "$ref": "#/definitions/v1Decision"
        },
        "grant": {
          "$ref": "#/definitions/v1NativeAccessGrant"
        }
      }
    },
    "v1NodeAckState": {
      "type": "object",
      "properties": {
        "nodeId": {
          "type": "string"
        },
        "resourceType": {
          "$ref": "#/definitions/v1ResourceType"
        },
        "subscribedNames": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "acceptedVersion": {
          "type": "string"
        },
        "lastGoodVersion": {
          "type": "string"
        },
        "lastResponseNonce": {
          "type": "string"
        },
        "nackErrorDetail": {
          "type": "string"
        },
        "inSync": {
          "type": "boolean",
          "description": "True when the node's accepted_version matches the current version-of-world."
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "description": "Admin-visible projection of one ControlPlaneNodeState row."
    },
    "v1NotificationChannel": {
      "type": "string",
      "enum": [
        "NOTIFICATION_CHANNEL_UNSPECIFIED",
        "NOTIFICATION_CHANNEL_EMAIL",
        "NOTIFICATION_CHANNEL_SMS",
        "NOTIFICATION_CHANNEL_PUSH",
        "NOTIFICATION_CHANNEL_IN_APP",
        "NOTIFICATION_CHANNEL_WEBHOOK"
      ],
      "default": "NOTIFICATION_CHANNEL_UNSPECIFIED",
      "title": "- NOTIFICATION_CHANNEL_PUSH: Mobile push via FCM/APNs\n - NOTIFICATION_CHANNEL_IN_APP: In-app notification bell\n - NOTIFICATION_CHANNEL_WEBHOOK: Outbound HTTP webhook"
    },
    "v1NotificationDeliveryAttempt": {
      "type": "object",
      "properties": {
        "attemptId": {
          "type": "string"
        },
        "notificationId": {
          "type": "string",
          "description": "The NotificationLog (intent) this delivery outcome is for."
        },
        "tenantId": {
          "type": "string"
        },
        "channel": {
          "$ref": "#/definitions/v1NotificationChannel"
        },
        "provider": {
          "type": "string",
          "description": "Delivery provider that handled (or will handle) this channel: SES, SMTP,\nTWILIO, FCM, etc."
        },
        "status": {
          "$ref": "#/definitions/v1NotificationStatus",
          "description": "queued(PENDING) | sent(SENT) | delivered(DELIVERED) | failed(FAILED)."
        },
        "attemptCount": {
          "type": "integer",
          "format": "int32"
        },
        "lastError": {
          "type": "string"
        },
        "providerMessageId": {
          "type": "string",
          "description": "The delivery provider's message id (SES, Twilio, FCM, …) for the terminal attempt."
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time",
          "description": "The \"ts\" of the latest reported outcome."
        },
        "projectId": {
          "type": "string",
          "description": "First-class project owner. Blank is reserved for quarantined legacy rows;\nserving paths persist only an explicitly active resolved project."
        }
      },
      "description": "---------------------------------------------------------------------------\nNotificationDeliveryAttempt — master-plan 9.13 delivery-status record.\n\nThe broker records each notification SEND as a PENDING NotificationLog\n(intent). A leader-elected delivery worker, or a provider webhook bridge that\ncalls NotificationService.ReportDelivery, then drives the terminal per-channel\ndelivery outcome here: one durable, tenant+project-scoped row per\n(notification, channel, provider) carrying the queued/sent/failed/delivered status, the\nattempt count, the provider's message id, the last error, and a timestamp.\nThis EXTENDS the existing intent/outbox path — it does not replace it. RLS\nscopes rows to the current tenant and project.\n---------------------------------------------------------------------------"
    },
    "v1NotificationLog": {
      "type": "object",
      "properties": {
        "logId": {
          "type": "string"
        },
        "templateId": {
          "type": "string"
        },
        "eventType": {
          "type": "string"
        },
        "channel": {
          "$ref": "#/definitions/v1NotificationChannel"
        },
        "recipientId": {
          "type": "string"
        },
        "recipientAddress": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "resourceType": {
          "type": "string"
        },
        "resourceId": {
          "type": "string"
        },
        "resourceName": {
          "type": "string"
        },
        "correlationId": {
          "type": "string"
        },
        "status": {
          "$ref": "#/definitions/v1NotificationStatus"
        },
        "errorMessage": {
          "type": "string"
        },
        "providerMessageId": {
          "type": "string"
        },
        "retryCount": {
          "type": "integer",
          "format": "int32"
        },
        "sentAt": {
          "type": "string",
          "format": "date-time"
        },
        "deliveredAt": {
          "type": "string",
          "format": "date-time"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "renderedSubject": {
          "type": "string"
        },
        "renderedBody": {
          "type": "string"
        }
      }
    },
    "v1NotificationPreference": {
      "type": "object",
      "properties": {
        "preferenceId": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "channel": {
          "$ref": "#/definitions/v1NotificationChannel"
        },
        "eventType": {
          "type": "string",
          "description": "Empty string = channel-wide opt-out; non-empty = opt-out of specific event type."
        },
        "isOptedOut": {
          "type": "boolean"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "createdBy": {
          "type": "string"
        },
        "projectId": {
          "type": "string",
          "description": "First-class project owner. Blank is reserved for quarantined legacy rows;\nserving paths persist only an explicitly active resolved project."
        }
      }
    },
    "v1NotificationStatus": {
      "type": "string",
      "enum": [
        "NOTIFICATION_STATUS_UNSPECIFIED",
        "NOTIFICATION_STATUS_PENDING",
        "NOTIFICATION_STATUS_SENT",
        "NOTIFICATION_STATUS_DELIVERED",
        "NOTIFICATION_STATUS_FAILED",
        "NOTIFICATION_STATUS_SUPPRESSED"
      ],
      "default": "NOTIFICATION_STATUS_UNSPECIFIED",
      "title": "- NOTIFICATION_STATUS_SUPPRESSED: Rate-limited or user preference suppressed"
    },
    "v1NotificationTemplate": {
      "type": "object",
      "properties": {
        "templateId": {
          "type": "string"
        },
        "eventType": {
          "type": "string",
          "description": "Machine code such as RESOURCE_CREATED, SLA_BREACH_WARNING, REVIEW_ASSIGNED.\nPartial unique indexes above permit one project-global default and one\nper-tenant override for the same event/channel in each exact project."
        },
        "channel": {
          "$ref": "#/definitions/v1NotificationChannel"
        },
        "subjectTemplate": {
          "type": "string"
        },
        "bodyTemplate": {
          "type": "string"
        },
        "locale": {
          "type": "string"
        },
        "isActive": {
          "type": "boolean"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "createdBy": {
          "type": "string"
        },
        "deletedBy": {
          "type": "string"
        },
        "tenantId": {
          "type": "string",
          "description": "NULLABLE: NULL = project-global default template; non-null = per-tenant override."
        },
        "projectId": {
          "type": "string",
          "description": "First-class project owner. Blank is reserved for quarantined legacy rows;\nserving paths persist only an explicitly active resolved project."
        }
      }
    },
    "v1OTPType": {
      "type": "string",
      "enum": [
        "OTP_TYPE_UNSPECIFIED",
        "OTP_TYPE_EMAIL_VERIFICATION",
        "OTP_TYPE_LOGIN_2FA",
        "OTP_TYPE_PASSWORD_RESET",
        "OTP_TYPE_SENSITIVE_OPERATION",
        "OTP_TYPE_PHONE_VERIFICATION"
      ],
      "default": "OTP_TYPE_UNSPECIFIED",
      "description": " - OTP_TYPE_EMAIL_VERIFICATION: New account email confirmation\n - OTP_TYPE_LOGIN_2FA: Login second-factor (email OTP)\n - OTP_TYPE_PASSWORD_RESET: Password reset\n - OTP_TYPE_SENSITIVE_OPERATION: Step-up auth for a protected action.\n - OTP_TYPE_PHONE_VERIFICATION: Phone-number confirmation via SMS OTP."
    },
    "v1PageRequest": {
      "type": "object",
      "properties": {
        "page": {
          "type": "integer",
          "format": "int32"
        },
        "pageSize": {
          "type": "integer",
          "format": "int32"
        },
        "pageToken": {
          "type": "string"
        }
      }
    },
    "v1PageResponse": {
      "type": "object",
      "properties": {
        "page": {
          "type": "integer",
          "format": "int32"
        },
        "pageSize": {
          "type": "integer",
          "format": "int32"
        },
        "totalItems": {
          "type": "string",
          "format": "int64"
        },
        "totalPages": {
          "type": "integer",
          "format": "int32"
        },
        "nextPageToken": {
          "type": "string"
        },
        "totalCount": {
          "type": "string",
          "format": "int64"
        },
        "hasNext": {
          "type": "boolean"
        },
        "hasPrevious": {
          "type": "boolean"
        }
      }
    },
    "v1PauseJobResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1Peer": {
      "type": "object",
      "properties": {
        "peerId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:peer_id;not null\""
        },
        "roomId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:room_id;not null\""
        },
        "tenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:tenant_id;not null\""
        },
        "displayName": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:display_name\""
        },
        "state": {
          "$ref": "#/definitions/v1PeerState",
          "title": "@inject_tag: gorm:\"column:state;not null;serializer:proto_enum\""
        },
        "metadata": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:metadata\""
        },
        "userAgent": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:user_agent\""
        },
        "joinedAt": {
          "type": "string",
          "format": "date-time"
        },
        "leftAt": {
          "type": "string",
          "format": "date-time"
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedBy": {
          "type": "string"
        }
      },
      "description": "Peer: a participant connection within a room."
    },
    "v1PeerState": {
      "type": "string",
      "enum": [
        "PEER_STATE_UNSPECIFIED",
        "PEER_STATE_NEW",
        "PEER_STATE_CONNECTING",
        "PEER_STATE_CONNECTED",
        "PEER_STATE_DISCONNECTED",
        "PEER_STATE_FAILED",
        "PEER_STATE_CLOSED"
      ],
      "default": "PEER_STATE_UNSPECIFIED"
    },
    "v1PermissionCheck": {
      "type": "object",
      "properties": {
        "object": {
          "type": "string"
        },
        "action": {
          "type": "string"
        }
      }
    },
    "v1PipelineDefinition": {
      "type": "object",
      "properties": {
        "definitionId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:definition_id;not null\""
        },
        "tenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:tenant_id;not null\""
        },
        "name": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:name;not null\""
        },
        "description": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:description\""
        },
        "mediaType": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:media_type\""
        },
        "steps": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:steps;not null\""
        },
        "version": {
          "type": "integer",
          "format": "int32",
          "title": "@inject_tag: gorm:\"column:version;not null\""
        },
        "status": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:status;not null\""
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        },
        "triggerTopic": {
          "type": "string",
          "description": "Optional Kafka topic that fires this pipeline (master-plan 5.2). When set, the\nleader-elected trigger manager runs exactly one consumer per distinct\ntrigger_topic cluster-wide and starts this pipeline for each inbound event.\nAdditive; NULL/empty = not Kafka-triggered (the static storage-finalized\nauto-trigger still applies, matched by media_type).\n\n@inject_tag: gorm:\"column:trigger_topic\""
        }
      },
      "description": "PipelineDefinition is a reusable, versioned processing-pipeline template."
    },
    "v1PipelineInstance": {
      "type": "object",
      "properties": {
        "instanceId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:instance_id;not null\""
        },
        "definitionId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:definition_id;not null\""
        },
        "assetId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:asset_id;not null\""
        },
        "tenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:tenant_id;not null\""
        },
        "status": {
          "$ref": "#/definitions/v1PipelineStatus",
          "title": "@inject_tag: gorm:\"column:status;not null;serializer:proto_enum\""
        },
        "currentStep": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:current_step\""
        },
        "context": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:context\""
        },
        "correlationId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:correlation_id\""
        },
        "startedAt": {
          "type": "string",
          "format": "date-time",
          "title": "@inject_tag: gorm:\"column:started_at\""
        },
        "completedAt": {
          "type": "string",
          "format": "date-time",
          "title": "@inject_tag: gorm:\"column:completed_at\""
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        }
      },
      "description": "PipelineInstance is a single execution of a PipelineDefinition against an Asset."
    },
    "v1PipelineMetricSnapshot": {
      "type": "object",
      "properties": {
        "snapshotId": {
          "type": "string"
        },
        "snapshotHour": {
          "type": "string",
          "format": "date-time",
          "title": "ISO 8601 truncated to the hour: 2025-07-15T14:00:00Z"
        },
        "stageName": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "totalRequests": {
          "type": "string",
          "format": "int64"
        },
        "successful": {
          "type": "string",
          "format": "int64"
        },
        "failed": {
          "type": "string",
          "format": "int64"
        },
        "p50LatencyMs": {
          "type": "number",
          "format": "double"
        },
        "p95LatencyMs": {
          "type": "number",
          "format": "double"
        },
        "p99LatencyMs": {
          "type": "number",
          "format": "double"
        },
        "avgLatencyMs": {
          "type": "number",
          "format": "double"
        },
        "errorRate": {
          "type": "number",
          "format": "double"
        },
        "throughputRps": {
          "type": "number",
          "format": "double"
        },
        "recordedAt": {
          "type": "string",
          "format": "date-time"
        }
      }
    },
    "v1PipelineStatus": {
      "type": "string",
      "enum": [
        "PIPELINE_STATUS_UNSPECIFIED",
        "PIPELINE_STATUS_PENDING",
        "PIPELINE_STATUS_RUNNING",
        "PIPELINE_STATUS_COMPLETED",
        "PIPELINE_STATUS_FAILED"
      ],
      "default": "PIPELINE_STATUS_UNSPECIFIED"
    },
    "v1PipelineStep": {
      "type": "object",
      "properties": {
        "stepId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:step_id;not null\""
        },
        "instanceId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:instance_id;not null\""
        },
        "tenantId": {
          "type": "string",
          "description": "Denormalized from the owning pipeline_instance so the tenant RLS policy can\nfilter steps directly (steps are created by the service from the instance).\n\n@inject_tag: gorm:\"column:tenant_id;not null\""
        },
        "stepName": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:step_name;not null\""
        },
        "stepType": {
          "$ref": "#/definitions/v1StepType",
          "title": "@inject_tag: gorm:\"column:step_type;not null;serializer:proto_enum\""
        },
        "status": {
          "$ref": "#/definitions/v1StepStatus",
          "title": "@inject_tag: gorm:\"column:status;not null;serializer:proto_enum\""
        },
        "result": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:result\""
        },
        "params": {
          "type": "string",
          "description": "Transform parameters applied to a byte/image step, as a JSON object, e.g.\n{\"width\":800,\"height\":600,\"format\":\"jpeg\"}. RESIZE reads width/height;\nCONVERT (format-only RESIZE) reads format. Empty `{}` for steps that take no\nparameters. Additive: lets RESIZE/CONVERT be parameterized instead of a\nhardcoded 256x256/png, and surfaces the applied params on read.\n\n@inject_tag: gorm:\"column:params;not null\""
        },
        "error": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:error\""
        },
        "retryCount": {
          "type": "integer",
          "format": "int32",
          "title": "@inject_tag: gorm:\"column:retry_count;not null\""
        },
        "startedAt": {
          "type": "string",
          "format": "date-time",
          "title": "@inject_tag: gorm:\"column:started_at\""
        },
        "completedAt": {
          "type": "string",
          "format": "date-time",
          "title": "@inject_tag: gorm:\"column:completed_at\""
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        }
      },
      "description": "PipelineStep is one executable unit within a PipelineInstance."
    },
    "v1PolicyApproval": {
      "type": "object",
      "properties": {
        "approvalId": {
          "type": "string"
        },
        "draftId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "actor": {
          "type": "string"
        },
        "role": {
          "type": "string"
        },
        "decision": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "description": "A single reviewer/approver decision recorded against a PolicyDraft (Phase K\ndraft/approval workflow). Separation of duties is enforced in the handler: the\ndraft author cannot record an APPROVE decision (author != approver). Each row\nis one actor's REVIEWER/APPROVER decision with a mandatory reason.\n\n⚠️ CROSS-SESSION: field set reconstructed to EXACTLY match the governance\nsession's `governance_store.rs::load_approval` struct literal (the source of\ntruth). The governance-session owner should confirm / restore their canonical\nfile."
    },
    "v1PolicyApprovalResponse": {
      "type": "object",
      "properties": {
        "draft": {
          "$ref": "#/definitions/v1PolicyDraft"
        },
        "approval": {
          "$ref": "#/definitions/v1PolicyApproval"
        },
        "version": {
          "$ref": "#/definitions/v1PolicyVersion",
          "description": "The promoted version, present once the draft is approved."
        }
      }
    },
    "v1PolicyBundleRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        }
      },
      "description": "`GetPolicyBundle` serializes the live authorization snapshot (policies,\nrole bindings, relationship tuples) and signs it so an SDK can cache it\nand answer `can()` locally without a round-trip, while still being able\nto verify the bundle was issued by UDB and has not expired.",
      "title": "── Stage 2: signed policy bundles for local SDK authorization caches ───────"
    },
    "v1PolicyBundleResponse": {
      "type": "object",
      "properties": {
        "bundle": {
          "$ref": "#/definitions/v1SignedPolicyBundle"
        }
      }
    },
    "v1PolicyCanary": {
      "type": "object",
      "properties": {
        "canaryId": {
          "type": "string"
        },
        "policySetId": {
          "type": "string"
        },
        "policyVersionId": {
          "type": "string"
        },
        "scopeKind": {
          "$ref": "#/definitions/v1CanaryScopeKind"
        },
        "scopeValues": {
          "type": "string",
          "description": "For NODE/TENANT: the list of in-scope ids. For PERCENT: a single-element\nlist whose value is the integer percentage (1..=100)."
        },
        "state": {
          "$ref": "#/definitions/v1CanaryState"
        },
        "startedAt": {
          "type": "string",
          "format": "date-time"
        },
        "successWindowSecs": {
          "type": "string",
          "format": "int64",
          "description": "The evaluator waits at least this long before declaring success."
        },
        "metricThreshold": {
          "type": "number",
          "format": "double",
          "description": "The success metric breach threshold (e.g. fractional authz deny/error rate).\nA measured value strictly greater than this inside the window auto-rolls back."
        },
        "createdBy": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "minSamples": {
          "type": "string",
          "format": "int64",
          "description": "Minimum sample count required for a conclusive evaluation. Below this the\ncanary PAUSES instead of promoting or rolling back."
        },
        "rollbackVersionId": {
          "type": "string",
          "description": "The version a rollback restores to (the policy set's active version at\ncanary-creation time). Recorded so auto-rollback is deterministic."
        },
        "outcomeReason": {
          "type": "string",
          "description": "Why the canary left ACTIVE (breach reason, 'promoted', 'inconclusive')."
        },
        "revision": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "A progressive-rollout canary: a `PolicyVersion` exposed to a SUBSET of the\nfleet (by node id, tenant id, or percentage) and watched by a metric-based\nevaluator before fleet-wide promotion. If the success metric breaches\n`metric_threshold` within `success_window_secs`, the canary auto-rolls back\nto the policy set's prior version BEFORE fleet-wide impact; if the window\npasses within threshold it becomes promote-eligible; if samples are\ninsufficient it pauses. Every state transition is audited."
    },
    "v1PolicyDiffEntry": {
      "type": "object",
      "properties": {
        "change": {
          "type": "string",
          "title": "\"added\" | \"removed\" | \"changed\""
        },
        "kind": {
          "type": "string",
          "title": "\"policy\" | \"role_binding\" | \"relationship_tuple\""
        },
        "id": {
          "type": "string"
        },
        "beforeJson": {
          "type": "string"
        },
        "afterJson": {
          "type": "string"
        }
      }
    },
    "v1PolicyDocument": {
      "type": "object",
      "properties": {
        "policies": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1AuthzPolicyRecord"
          }
        },
        "roleBindings": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1RoleBinding"
          }
        },
        "relationshipTuples": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1RelationshipTuple"
          }
        }
      },
      "description": "A candidate policy document the governance APIs operate on (drafts and\nsimulations). Unifies the full field richness of CreatePolicyRule and\nPutAuthzPolicy (role, purpose, relationship, priority, required scopes,\nconditions, tenant, project, domain) so every governed surface is parity."
    },
    "v1PolicyDraft": {
      "type": "object",
      "properties": {
        "draftId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "proposedPoliciesJson": {
          "type": "string"
        },
        "proposedTuplesJson": {
          "type": "string"
        },
        "baseVersionId": {
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "author": {
          "type": "string"
        },
        "highRisk": {
          "type": "boolean"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "description": "An editable, in-progress policy change set under review (Phase K draft/approval\nworkflow). Holds the proposed policies/tuples as JSON; when approved it is\npromoted into an immutable numbered PolicyVersion. Drafts never affect live\ndecisions.\n\n⚠️ CROSS-SESSION: field set reconstructed to EXACTLY match the governance\nsession's `governance_store.rs::load_draft` struct literal (the source of\ntruth). The governance-session owner should still confirm this is their\nintended schema / restore their canonical file."
    },
    "v1PolicyDraftResponse": {
      "type": "object",
      "properties": {
        "draft": {
          "$ref": "#/definitions/v1PolicyDraft"
        },
        "policySet": {
          "$ref": "#/definitions/v1PolicySet"
        },
        "document": {
          "$ref": "#/definitions/v1PolicyDocument",
          "description": "Document parsed back from the stored draft (convenience)."
        }
      }
    },
    "v1PolicyEffect": {
      "type": "string",
      "enum": [
        "POLICY_EFFECT_UNSPECIFIED",
        "POLICY_EFFECT_ALLOW",
        "POLICY_EFFECT_DENY"
      ],
      "default": "POLICY_EFFECT_UNSPECIFIED"
    },
    "v1PolicyRule": {
      "type": "object",
      "properties": {
        "policyId": {
          "type": "string"
        },
        "subject": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        },
        "object": {
          "type": "string"
        },
        "action": {
          "type": "string"
        },
        "effect": {
          "$ref": "#/definitions/v1PolicyEffect"
        },
        "condition": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "isActive": {
          "type": "boolean"
        },
        "createdBy": {
          "type": "string"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "tenantId": {
          "type": "string"
        },
        "deletedBy": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "resourceType": {
          "type": "string"
        },
        "attributesJson": {
          "type": "string"
        }
      },
      "description": "Managed permission rule mapped into UDB authorization policy rows."
    },
    "v1PolicySet": {
      "type": "object",
      "properties": {
        "policySetId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "activeVersionId": {
          "type": "string"
        },
        "rollbackVersionId": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "createdBy": {
          "type": "string"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "description": "A governed collection of policy versions. Each tenant/project/name names one\npolicy set; its `active_version_id` points at the currently-enforced\n`PolicyVersion`, and `rollback_version_id` records the version a rollback\nrestored to. Drafts are created against a policy set and only take effect\nonce a version is activated (Phase K governance workflow)."
    },
    "v1PolicyVersion": {
      "type": "object",
      "properties": {
        "policyVersionId": {
          "type": "string"
        },
        "policySetId": {
          "type": "string"
        },
        "versionNumber": {
          "type": "string",
          "format": "int64"
        },
        "state": {
          "$ref": "#/definitions/v1PolicyVersionState"
        },
        "snapshotHash": {
          "type": "string"
        },
        "createdBy": {
          "type": "string"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "activatedBy": {
          "type": "string"
        },
        "activatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "rollbackOf": {
          "type": "string"
        },
        "changeReason": {
          "type": "string"
        },
        "revision": {
          "type": "string",
          "format": "int64"
        },
        "contentHash": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "payloadJson": {
          "type": "string",
          "description": "Frozen candidate document: { \"policies\": [...], \"role_bindings\": [...], \"relationship_tuples\": [...] }."
        },
        "highRisk": {
          "type": "boolean"
        },
        "submittedBy": {
          "type": "string"
        },
        "sourceDraftId": {
          "type": "string",
          "description": "The PolicyDraft this version was promoted from, if any."
        }
      },
      "description": "An immutable, numbered version of a policy set. A `PolicyDraft` that passes\nreview is promoted into a `PolicyVersion` whose frozen `payload_json`\n(policies + role bindings + relationship tuples) is what\n`ActivatePolicyVersion` loads into the live authorization snapshot. Drafts\nremain editable; versions never change once created — they only transition\nstate (draft -> pending_review -> approved -> active -> superseded /\nrejected / rolled_back). `revision` provides optimistic concurrency over the\nversion's state transitions; `content_hash` detects no-op promotions."
    },
    "v1PolicyVersionState": {
      "type": "string",
      "enum": [
        "POLICY_VERSION_STATE_UNSPECIFIED",
        "POLICY_VERSION_STATE_DRAFT",
        "POLICY_VERSION_STATE_PENDING_REVIEW",
        "POLICY_VERSION_STATE_APPROVED",
        "POLICY_VERSION_STATE_ACTIVE",
        "POLICY_VERSION_STATE_SUPERSEDED",
        "POLICY_VERSION_STATE_REJECTED",
        "POLICY_VERSION_STATE_ROLLED_BACK"
      ],
      "default": "POLICY_VERSION_STATE_UNSPECIFIED",
      "description": "Lifecycle state of a governed policy version (Phase K draft/approval workflow)."
    },
    "v1PreviewClaimMappingResponse": {
      "type": "object",
      "properties": {
        "subject": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "emailVerified": {
          "type": "boolean"
        },
        "displayName": {
          "type": "string"
        },
        "groups": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "assurance": {
          "$ref": "#/definitions/v1AssuranceLevel"
        },
        "mappedPrincipalJson": {
          "type": "string",
          "description": "Fully-resolved principal fields as JSON for inspection."
        }
      }
    },
    "v1PreviewGroupMappingResponse": {
      "type": "object",
      "properties": {
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Roles granted (only roles explicitly present in the mapping)."
        },
        "unmappedGroups": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Input groups that matched no mapping entry (granted nothing)."
        }
      }
    },
    "v1PrincipalKind": {
      "type": "string",
      "enum": [
        "PRINCIPAL_KIND_UNSPECIFIED",
        "PRINCIPAL_KIND_USER",
        "PRINCIPAL_KIND_SERVICE_ACCOUNT",
        "PRINCIPAL_KIND_WORKLOAD",
        "PRINCIPAL_KIND_GROUP",
        "PRINCIPAL_KIND_ROLE",
        "PRINCIPAL_KIND_EXTERNAL_SUBJECT"
      ],
      "default": "PRINCIPAL_KIND_UNSPECIFIED"
    },
    "v1PromoteCanaryRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "canaryId": {
          "type": "string"
        },
        "expectedRevision": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "Promote a baked (within-threshold) canary to fleet-wide. Fails unless the\ncanary is promote-eligible (ACTIVE and its success window has elapsed within\nthreshold). On success the canaried version becomes the active version of its\npolicy set fleet-wide and the canary moves to PROMOTED."
    },
    "v1ProviderHealth": {
      "type": "string",
      "enum": [
        "PROVIDER_HEALTH_UNSPECIFIED",
        "PROVIDER_HEALTH_HEALTHY",
        "PROVIDER_HEALTH_DEGRADED",
        "PROVIDER_HEALTH_UNREACHABLE"
      ],
      "default": "PROVIDER_HEALTH_UNSPECIFIED",
      "description": "Health of a provider's discovery + key material.\n\n - PROVIDER_HEALTH_DEGRADED: last refresh failed, serving cached keys\n - PROVIDER_HEALTH_UNREACHABLE: discovery/JWKS unreachable, no usable keys"
    },
    "v1PublishTrackRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "roomId": {
          "type": "string"
        },
        "peerId": {
          "type": "string"
        },
        "kind": {
          "type": "string"
        },
        "label": {
          "type": "string"
        },
        "settings": {
          "type": "string",
          "title": "JSON"
        },
        "metadata": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1PublishTrackResponse": {
      "type": "object",
      "properties": {
        "trackId": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1PurgeExcludedTable": {
      "type": "object",
      "properties": {
        "schema": {
          "type": "string"
        },
        "table": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        }
      },
      "description": "An entity table the purge SKIPPED because it has no resolvable tenant column.\nReported, never silently dropped (capability honesty)."
    },
    "v1PurgeTenantResponse": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "purged": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PurgedTableCount"
          },
          "description": "Per-table hard-delete counts, in execution (children->parents) order."
        },
        "excluded": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PurgeExcludedTable"
          },
          "description": "Tenant-less tables reported as excluded from the ripple."
        },
        "totalDeleted": {
          "type": "string",
          "format": "uint64"
        },
        "tenantDenylisted": {
          "type": "boolean",
          "description": "Whether the tenant-level cluster denylist cutoff was recorded (best-effort)."
        },
        "principalsDenylisted": {
          "type": "integer",
          "format": "int64",
          "description": "How many principals had a denylist cutoff recorded (best-effort)."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1PurgedTableCount": {
      "type": "object",
      "properties": {
        "schema": {
          "type": "string"
        },
        "table": {
          "type": "string"
        },
        "tenantColumn": {
          "type": "string"
        },
        "deleted": {
          "type": "string",
          "format": "uint64"
        }
      },
      "description": "One entity table the purge hard-deleted the tenant's rows from."
    },
    "v1PutAuthzPolicyRequest": {
      "type": "object",
      "properties": {
        "policy": {
          "$ref": "#/definitions/v1AuthzPolicyRecord"
        }
      }
    },
    "v1PutBackupPolicyRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "policyName": {
          "type": "string"
        },
        "scheduleCron": {
          "type": "string"
        },
        "retentionDays": {
          "type": "integer",
          "format": "int32"
        },
        "maxRetainedBackups": {
          "type": "integer",
          "format": "int32"
        },
        "enabled": {
          "type": "boolean"
        },
        "objectBackend": {
          "type": "string"
        },
        "objectBucket": {
          "type": "string"
        },
        "metadataJson": {
          "type": "string"
        }
      }
    },
    "v1PutBackupPolicyResponse": {
      "type": "object",
      "properties": {
        "policyId": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1PutFlagRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected."
        },
        "projectId": {
          "type": "string"
        },
        "environment": {
          "type": "string"
        },
        "flagKey": {
          "type": "string"
        },
        "value": {
          "$ref": "#/definitions/v1FlagValue"
        },
        "enabled": {
          "type": "boolean"
        },
        "rolloutPercentage": {
          "type": "integer",
          "format": "int32"
        },
        "rolloutContextKey": {
          "type": "string"
        },
        "metadataJson": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1PutFlagResponse": {
      "type": "object",
      "properties": {
        "stored": {
          "type": "boolean"
        },
        "flagKey": {
          "type": "string"
        },
        "revision": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1PutMfaPolicyResponse": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "requireMfa": {
          "type": "boolean"
        }
      }
    },
    "v1PutQuotaRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "metric": {
          "type": "string"
        },
        "limitValue": {
          "type": "string",
          "format": "int64"
        },
        "windowSeconds": {
          "type": "string",
          "format": "int64"
        },
        "enabled": {
          "type": "boolean"
        },
        "metadataJson": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1PutQuotaResponse": {
      "type": "object",
      "properties": {
        "stored": {
          "type": "boolean"
        },
        "metric": {
          "type": "string"
        },
        "revision": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1PutRelationshipRequest": {
      "type": "object",
      "properties": {
        "tuple": {
          "$ref": "#/definitions/v1RelationshipTuple"
        }
      }
    },
    "v1PutRoleBindingRequest": {
      "type": "object",
      "properties": {
        "binding": {
          "$ref": "#/definitions/v1RoleBinding"
        }
      }
    },
    "v1PutSecretRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected."
        },
        "secretPath": {
          "type": "string",
          "description": "Application-relative path, e.g. \"app/db/password\"."
        },
        "secretValue": {
          "type": "string",
          "description": "The plaintext secret value. Sealed under a fresh DEK before storage; never\nlogged (redacting markers) and never returned by List."
        },
        "expectedVersion": {
          "type": "integer",
          "format": "int32",
          "description": "Compare-and-swap guard: must equal the current latest version (0 for a new\npath). A mismatch is rejected (aborted) so concurrent writers cannot clobber."
        },
        "metadataJson": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1PutSecretResponse": {
      "type": "object",
      "properties": {
        "secretPath": {
          "type": "string"
        },
        "version": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1QueryUsageRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "metric": {
          "type": "string"
        },
        "windowSeconds": {
          "type": "string",
          "format": "int64",
          "description": "Rolling window length in seconds; 0 defaults to 24h."
        }
      }
    },
    "v1QueryUsageResponse": {
      "type": "object",
      "properties": {
        "metric": {
          "type": "string"
        },
        "used": {
          "type": "string",
          "format": "int64"
        },
        "windowSeconds": {
          "type": "string",
          "format": "int64"
        },
        "fromUnix": {
          "type": "string",
          "format": "int64"
        },
        "toUnix": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1QuotaState": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "metric": {
          "type": "string"
        },
        "limitValue": {
          "type": "string",
          "format": "int64"
        },
        "windowSeconds": {
          "type": "string",
          "format": "int64"
        },
        "enabled": {
          "type": "boolean"
        },
        "revision": {
          "type": "string",
          "format": "int64"
        },
        "metadataJson": {
          "type": "string"
        }
      },
      "description": "A stored quota rule returned by Get/List."
    },
    "v1ReconciliationAnalyticsSummary": {
      "type": "object",
      "properties": {
        "summaryId": {
          "type": "string"
        },
        "summaryDate": {
          "type": "string",
          "format": "date-time"
        },
        "totalReconciliations": {
          "type": "string",
          "format": "int64"
        },
        "exactMatches": {
          "type": "string",
          "format": "int64"
        },
        "partialConflicts": {
          "type": "string",
          "format": "int64"
        },
        "hardConflicts": {
          "type": "string",
          "format": "int64"
        },
        "lowConfidenceFlagged": {
          "type": "string",
          "format": "int64"
        },
        "avgReconciliationMs": {
          "type": "number",
          "format": "double"
        },
        "resolutionRate": {
          "type": "number",
          "format": "double"
        },
        "avgRecordConfidence": {
          "type": "number",
          "format": "double"
        },
        "recordedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "description": "Daily reconciliation/conflict roll-up for projections, imports, replicated\nstores, and project-defined resolution workflows."
    },
    "v1RecordPipelineMetricRequest": {
      "type": "object",
      "properties": {
        "stageName": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "latencyMs": {
          "type": "number",
          "format": "double",
          "description": "Raw observation for a single request (will be aggregated hourly)."
        },
        "isSuccess": {
          "type": "boolean"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1RecordPipelineMetricResponse": {
      "type": "object",
      "properties": {
        "accepted": {
          "type": "boolean"
        }
      }
    },
    "v1RecordUsageRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected."
        },
        "principalId": {
          "type": "string"
        },
        "method": {
          "type": "string"
        },
        "unit": {
          "type": "string"
        },
        "quantity": {
          "type": "string",
          "format": "int64"
        },
        "occurredAtUnix": {
          "type": "string",
          "format": "int64",
          "description": "Event time (unix seconds); 0 = server now."
        },
        "metadataJson": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1RecordUsageResponse": {
      "type": "object",
      "properties": {
        "recorded": {
          "type": "boolean",
          "description": "True when the durable append was attempted. Metering never fails the caller:\nan underlying store error is swallowed and surfaced as recorded=false."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1RefreshSessionResponse": {
      "type": "object",
      "properties": {
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "active": {
          "type": "boolean"
        }
      }
    },
    "v1RefreshTokenRequest": {
      "type": "object",
      "properties": {
        "refreshToken": {
          "type": "string"
        },
        "sessionId": {
          "type": "string"
        }
      }
    },
    "v1RefreshTokenResponse": {
      "type": "object",
      "properties": {
        "accessToken": {
          "type": "string"
        },
        "accessTokenExpiresIn": {
          "type": "integer",
          "format": "int32"
        },
        "refreshToken": {
          "type": "string",
          "description": "Rotated refresh token (token-family credential). Issued on every successful\nrefresh: the presented refresh token is single-use and is invalidated as the\nnew one is minted (atomic rotation). Empty when the caller refreshed with a\nlegacy server-side session id rather than a token-family credential."
        },
        "refreshTokenExpiresIn": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1RegisterAssetRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "fileId": {
          "type": "string",
          "description": "Stable public storage file UUID previously returned by StorageService."
        },
        "name": {
          "type": "string"
        },
        "mediaType": {
          "type": "string"
        },
        "metadata": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1RegisterAssetResponse": {
      "type": "object",
      "properties": {
        "assetId": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1RegisterModelRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "modelId": {
          "type": "string",
          "description": "Stable public model id in caller-chosen format (e.g. \"text-embedding-3-small@1\");\n1-255 chars, no credentials — the registry rejects ids that fail validation."
        },
        "provider": {
          "type": "string"
        },
        "modelName": {
          "type": "string"
        },
        "version": {
          "type": "string"
        },
        "dimensions": {
          "type": "integer",
          "format": "int32"
        },
        "matryoshkaDims": {
          "type": "array",
          "items": {
            "type": "integer",
            "format": "int32"
          }
        },
        "distanceMetric": {
          "type": "string"
        },
        "normalize": {
          "type": "boolean"
        },
        "outputDtype": {
          "type": "string"
        },
        "rescore": {
          "type": "boolean"
        },
        "maxInputTokens": {
          "type": "integer",
          "format": "int32"
        },
        "tokenizer": {
          "type": "string"
        },
        "taskType": {
          "type": "string"
        },
        "asymmetric": {
          "type": "boolean"
        },
        "providerEndpointRef": {
          "type": "string"
        },
        "vectorBackend": {
          "type": "string"
        },
        "vectorInstance": {
          "type": "string"
        },
        "collectionAlias": {
          "type": "string"
        },
        "activeCollection": {
          "type": "string"
        },
        "chunkingStrategy": {
          "type": "string"
        },
        "chunkTokens": {
          "type": "integer",
          "format": "int32"
        },
        "chunkOverlapTokens": {
          "type": "integer",
          "format": "int32"
        },
        "contextualRetrieval": {
          "type": "boolean"
        },
        "lateChunking": {
          "type": "boolean"
        },
        "metadataJson": {
          "type": "string"
        }
      }
    },
    "v1RegisterModelResponse": {
      "type": "object",
      "properties": {
        "modelId": {
          "type": "string"
        },
        "activeCollection": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1RegisterSourceRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected."
        },
        "sourceName": {
          "type": "string"
        },
        "sourceMessageType": {
          "type": "string",
          "description": "Fully-qualified source entity message type to embed on change."
        },
        "textFields": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Source field name(s) whose text is concatenated and sent to the sidecar."
        },
        "targetCollection": {
          "type": "string",
          "description": "Target vector collection the reported embedding is upserted into."
        },
        "modelId": {
          "type": "string",
          "description": "Stable public model id in caller-chosen provider format; credentials live\nin the sidecar and are not encoded in this identifier."
        },
        "metadataJson": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1RegisterSourceResponse": {
      "type": "object",
      "properties": {
        "sourceId": {
          "type": "string"
        },
        "sourceName": {
          "type": "string"
        },
        "tenantColumn": {
          "type": "string",
          "description": "The resolved SOURCE-table tenant column the source is scoped by."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1RegisterUploadRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "filename": {
          "type": "string"
        },
        "contentType": {
          "type": "string"
        },
        "fileType": {
          "type": "string"
        },
        "referenceId": {
          "type": "string"
        },
        "referenceType": {
          "type": "string"
        },
        "isPublic": {
          "type": "boolean",
          "description": "Optional initial visibility; absent defaults to private (false)."
        },
        "expiresInMinutes": {
          "type": "integer",
          "format": "int32"
        },
        "sizeBytes": {
          "type": "string",
          "format": "int64",
          "description": "Declared upload size in bytes, used for the pre-upload tenant quota check."
        }
      }
    },
    "v1RegisterUploadResponse": {
      "type": "object",
      "properties": {
        "fileId": {
          "type": "string"
        },
        "uploadUrl": {
          "type": "string"
        },
        "objectKey": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "expiresAt": {
          "type": "string",
          "format": "int64",
          "description": "Unix-seconds expiry of the presigned PUT `upload_url`; 0 when no URL was\nminted (metadata-only mode / presign error). Lets the client know when the\nURL dies without a follow-up call."
        }
      }
    },
    "v1ReindexRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "indexName": {
          "type": "string"
        }
      }
    },
    "v1ReindexResponse": {
      "type": "object",
      "properties": {
        "reindexId": {
          "type": "string"
        },
        "accepted": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1ReissueUploadUrlResponse": {
      "type": "object",
      "properties": {
        "fileId": {
          "type": "string"
        },
        "uploadUrl": {
          "type": "string"
        },
        "objectKey": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "expiresAt": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1RejectPolicyDraftRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "draftId": {
          "type": "string"
        },
        "reviewer": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        }
      }
    },
    "v1RelationshipTuple": {
      "type": "object",
      "properties": {
        "subject": {
          "type": "string"
        },
        "relation": {
          "type": "string"
        },
        "object": {
          "type": "string"
        },
        "tenant": {
          "type": "string"
        },
        "project": {
          "type": "string"
        },
        "version": {
          "type": "string",
          "format": "int64"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "source": {
          "type": "string"
        }
      },
      "description": "ReBAC tuple scoped to a tenant/project domain."
    },
    "v1ReleaseLockRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "lockName": {
          "type": "string"
        },
        "ownerId": {
          "type": "string"
        },
        "fencingToken": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1ReleaseLockResponse": {
      "type": "object",
      "properties": {
        "released": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1RenamePasskeyResponse": {
      "type": "object",
      "properties": {
        "renamed": {
          "type": "boolean"
        }
      }
    },
    "v1RenewLockRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "lockName": {
          "type": "string"
        },
        "ownerId": {
          "type": "string"
        },
        "fencingToken": {
          "type": "string",
          "format": "int64"
        },
        "leaseTtlSeconds": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1RenewLockResponse": {
      "type": "object",
      "properties": {
        "renewed": {
          "type": "boolean"
        },
        "fencingToken": {
          "type": "string",
          "format": "int64"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1ReplaceServiceAccountGrantResponse": {
      "type": "object",
      "properties": {
        "grant": {
          "$ref": "#/definitions/v1ServiceAccountGrant"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1ReportDeliveryResponse": {
      "type": "object",
      "properties": {
        "attempt": {
          "$ref": "#/definitions/v1NotificationDeliveryAttempt"
        }
      }
    },
    "v1RerankConfig": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean"
        },
        "strategy": {
          "$ref": "#/definitions/v1RerankStrategy"
        },
        "model": {
          "type": "string"
        },
        "topN": {
          "type": "integer",
          "format": "int32"
        },
        "failOpen": {
          "type": "boolean"
        }
      }
    },
    "v1RerankStrategy": {
      "type": "string",
      "enum": [
        "RERANK_STRATEGY_UNSPECIFIED",
        "RERANK_STRATEGY_CROSS_ENCODER",
        "RERANK_STRATEGY_LATE_INTERACTION"
      ],
      "default": "RERANK_STRATEGY_UNSPECIFIED"
    },
    "v1ResendOTPRequest": {
      "type": "object",
      "properties": {
        "originalOtpId": {
          "type": "string"
        },
        "reason": {
          "type": "string",
          "title": "\"not_received\" | \"expired\" | \"delivery_failed\""
        }
      }
    },
    "v1ResendOTPResponse": {
      "type": "object",
      "properties": {
        "otpId": {
          "type": "string"
        },
        "expiresInSeconds": {
          "type": "integer",
          "format": "int32"
        },
        "cooldownSeconds": {
          "type": "integer",
          "format": "int32"
        },
        "attemptsRemaining": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1ResetPasswordRequest": {
      "type": "object",
      "properties": {
        "otpId": {
          "type": "string"
        },
        "code": {
          "type": "string"
        },
        "newPassword": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1ResetPasswordResponse": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "changedAtUnix": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1ResolveExternalIdentityResponse": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "subject": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "provisioned": {
          "type": "boolean",
          "title": "a new user was created (JIT)"
        },
        "linked": {
          "type": "boolean",
          "title": "linked to an existing user"
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "assurance": {
          "$ref": "#/definitions/v1AssuranceLevel"
        },
        "detail": {
          "type": "string"
        }
      }
    },
    "v1Resource": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string"
        },
        "version": {
          "type": "string"
        },
        "payloadJson": {
          "type": "string"
        },
        "resourceType": {
          "$ref": "#/definitions/v1ResourceType"
        }
      },
      "description": "One versioned resource on the wire (a single ControlPlaneResource projection)."
    },
    "v1ResourceRef": {
      "type": "object",
      "properties": {
        "resourceType": {
          "type": "string"
        },
        "resourceName": {
          "type": "string"
        },
        "messageType": {
          "type": "string"
        },
        "schema": {
          "type": "string"
        },
        "table": {
          "type": "string"
        },
        "backend": {
          "type": "string"
        },
        "instance": {
          "type": "string"
        },
        "resourceId": {
          "type": "string"
        },
        "collection": {
          "type": "string"
        },
        "bucket": {
          "type": "string"
        },
        "path": {
          "type": "string"
        },
        "service": {
          "type": "string"
        },
        "api": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "v1ResourceType": {
      "type": "string",
      "enum": [
        "RESOURCE_TYPE_UNSPECIFIED",
        "RESOURCE_TYPE_ROUTING_POLICY",
        "RESOURCE_TYPE_METHOD_SECURITY_POLICY",
        "RESOURCE_TYPE_RLS_TENANT_POLICY",
        "RESOURCE_TYPE_NATIVE_SERVICE_ENABLEMENT",
        "RESOURCE_TYPE_BACKEND_TARGET_DEFINITION"
      ],
      "default": "RESOURCE_TYPE_UNSPECIFIED",
      "description": "- RESOURCE_TYPE_ROUTING_POLICY: Request routing / backend selection policy (references backend targets).\n - RESOURCE_TYPE_METHOD_SECURITY_POLICY: Per-RPC method-security policy (the proto endpoint_security map).\n - RESOURCE_TYPE_RLS_TENANT_POLICY: Row-level-security / tenant isolation policy (references backend targets).\n - RESOURCE_TYPE_NATIVE_SERVICE_ENABLEMENT: Which native control-plane services are enabled on a node.\n - RESOURCE_TYPE_BACKEND_TARGET_DEFINITION: Backend target/cluster definitions — the \"definitions\" that routing and\nRLS policies reference. Pushed BEFORE the referencing policies.",
      "title": "---------------------------------------------------------------------------\nResourceType — the kinds of control-plane configuration a node can subscribe\nto in the xDS-style versioned distribution stream. \"Definition\" resources\n(backend targets) MUST be pushed before referencing policies so a referencing\npolicy is never applied before its target exists (make-before-break).\n---------------------------------------------------------------------------"
    },
    "v1RestoreTenantRequest": {
      "type": "object",
      "properties": {
        "sourceTenantId": {
          "type": "string",
          "description": "The tenant whose backup is the source."
        },
        "targetTenantId": {
          "type": "string",
          "description": "The FRESH tenant the rows are restored INTO. Verified against the claim; an\nexisting (non-empty) tenant is refused."
        },
        "backupId": {
          "type": "string",
          "description": "The backup run id to restore (resolved to its object prefix)."
        },
        "confirmationToken": {
          "type": "string",
          "description": "Required explicit confirmation token (DESTRUCTIVE)."
        },
        "allowCrossTenant": {
          "type": "boolean",
          "description": "When the target differs from the source this must be set: a cross-tenant\nrestore needs explicit privileged approval (fail closed otherwise)."
        },
        "metadataJson": {
          "type": "string"
        }
      }
    },
    "v1RestoreTenantResponse": {
      "type": "object",
      "properties": {
        "backupId": {
          "type": "string",
          "description": "The restore journal row id."
        },
        "sourceObjectPrefix": {
          "type": "string"
        },
        "restoredTableCount": {
          "type": "integer",
          "format": "int32"
        },
        "restoredRows": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1ResumeJobResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1RetrieveHit": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "score": {
          "type": "number",
          "format": "double"
        },
        "payloadJson": {
          "type": "string",
          "title": "JSON"
        },
        "vector": {
          "type": "array",
          "items": {
            "type": "number",
            "format": "float"
          }
        },
        "sourceName": {
          "type": "string"
        },
        "parentPk": {
          "type": "string"
        },
        "chunkSeq": {
          "type": "integer",
          "format": "int32"
        },
        "documentId": {
          "type": "string"
        },
        "docVersion": {
          "type": "string"
        },
        "vectorName": {
          "type": "string"
        },
        "rerankScore": {
          "type": "number",
          "format": "double"
        }
      }
    },
    "v1RetrieveRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "sourceName": {
          "type": "string"
        },
        "queryText": {
          "type": "string",
          "description": "Optional lexical query; when present alongside query_vector, the delegated\nsearch runs hybrid (lexical + vector) fusion."
        },
        "queryVector": {
          "type": "array",
          "items": {
            "type": "number",
            "format": "float"
          },
          "description": "Already-embedded query vector (the broker never embeds the query)."
        },
        "topK": {
          "type": "integer",
          "format": "int32"
        },
        "filterJson": {
          "type": "string",
          "description": "Optional caller-supplied metadata filter (Qdrant-style JSON object with\n`must` / `should` / `must_not` condition arrays), merged UNDER the mandatory\nserver-side tenant clause. The verified `_tenant_id` `must` clause is always\napplied first and cannot be broadened by this filter; conditions referencing\nany internal `_`-prefixed payload key are rejected. Example:\n`{\"must\":[{\"key\":\"doc_type\",\"match\":{\"value\":\"invoice\"}}]}`."
        },
        "scoreThreshold": {
          "type": "number",
          "format": "double",
          "description": "Optional per-query minimum similarity score a hit must clear to be returned.\nRAISES (never lowers) the server-side floor, so a caller can demand\nhigher-precision results per query; <= 0 uses the server default. Applies to\nboth the vector and hybrid paths."
        },
        "includeVectors": {
          "type": "boolean"
        },
        "mmr": {
          "$ref": "#/definitions/v1MmrConfig"
        },
        "fusion": {
          "$ref": "#/definitions/v1FusionStrategy"
        },
        "prefetchLimit": {
          "type": "integer",
          "format": "int32"
        },
        "rerank": {
          "$ref": "#/definitions/v1RerankConfig"
        },
        "vectorName": {
          "type": "string"
        },
        "parentWindow": {
          "type": "integer",
          "format": "int32"
        },
        "includeCitations": {
          "type": "boolean"
        }
      }
    },
    "v1RetrieveResponse": {
      "type": "object",
      "properties": {
        "hits": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1RetrieveHit"
          }
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "indexLagMs": {
          "type": "string",
          "format": "int64"
        },
        "rerankApplied": {
          "type": "boolean"
        },
        "evaluationId": {
          "type": "string"
        }
      }
    },
    "v1RetryNotificationResponse": {
      "type": "object",
      "properties": {
        "log": {
          "$ref": "#/definitions/v1NotificationLog"
        }
      }
    },
    "v1RevokeApiKeyResponse": {
      "type": "object",
      "properties": {
        "keyId": {
          "type": "string"
        },
        "revokedAt": {
          "type": "string",
          "format": "date-time"
        },
        "operationId": {
          "type": "string"
        }
      }
    },
    "v1RevokeCertificateBindingResponse": {
      "type": "object",
      "properties": {
        "revoked": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1RevokeDatabaseCredentialsResponse": {
      "type": "object",
      "properties": {
        "leaseId": {
          "type": "string"
        },
        "state": {
          "type": "string"
        },
        "replayed": {
          "type": "boolean"
        },
        "operationId": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1RevokeDeviceResponse": {
      "type": "object",
      "properties": {
        "revoked": {
          "type": "boolean"
        },
        "deviceId": {
          "type": "string"
        },
        "sessionsRevoked": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1RevokeRecoveryCodesResponse": {
      "type": "object",
      "properties": {
        "revokedCount": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1RevokeRoleResponse": {
      "type": "object",
      "properties": {
        "revoked": {
          "type": "boolean"
        }
      }
    },
    "v1RevokeServiceAccountGrantResponse": {
      "type": "object",
      "properties": {
        "revoked": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1RevokeSessionResponse": {
      "type": "object",
      "properties": {
        "sessionId": {
          "type": "string"
        },
        "revokedAt": {
          "type": "string",
          "format": "date-time"
        },
        "operationId": {
          "type": "string"
        },
        "revokedCount": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1RewrapRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        },
        "ciphertext": {
          "type": "string"
        }
      }
    },
    "v1RewrapResponse": {
      "type": "object",
      "properties": {
        "ciphertext": {
          "type": "string"
        },
        "keyVersion": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1Role": {
      "type": "object",
      "properties": {
        "roleId": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "isSystem": {
          "type": "boolean"
        },
        "isActive": {
          "type": "boolean"
        },
        "createdBy": {
          "type": "string"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "tenantId": {
          "type": "string"
        },
        "deletedBy": {
          "type": "string"
        },
        "roleCode": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "scopeType": {
          "$ref": "#/definitions/v1RoleScopeType"
        },
        "accessSurface": {
          "type": "string"
        },
        "metadataJson": {
          "type": "string"
        }
      }
    },
    "v1RoleBinding": {
      "type": "object",
      "properties": {
        "subject": {
          "type": "string"
        },
        "role": {
          "type": "string"
        },
        "tenant": {
          "type": "string"
        },
        "project": {
          "type": "string"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "source": {
          "type": "string"
        }
      },
      "description": "RBAC binding scoped to a tenant/project domain."
    },
    "v1RoleScopeType": {
      "type": "string",
      "enum": [
        "ROLE_SCOPE_TYPE_UNSPECIFIED",
        "ROLE_SCOPE_TYPE_GLOBAL",
        "ROLE_SCOPE_TYPE_TENANT",
        "ROLE_SCOPE_TYPE_PROJECT",
        "ROLE_SCOPE_TYPE_RESOURCE",
        "ROLE_SCOPE_TYPE_EXTERNAL"
      ],
      "default": "ROLE_SCOPE_TYPE_UNSPECIFIED"
    },
    "v1RollbackPolicyVersionRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "policySetId": {
          "type": "string"
        },
        "targetVersionId": {
          "type": "string",
          "description": "Version to restore. Empty = the policy set's rollback_version_id."
        },
        "changeReason": {
          "type": "string"
        }
      }
    },
    "v1RollbackResourcesResponse": {
      "type": "object",
      "properties": {
        "rolledBackToVersion": {
          "type": "string",
          "description": "The retained version the resources were rolled back to (re-published)."
        },
        "currentVersion": {
          "type": "string",
          "description": "The aggregate world version after re-publishing (content-addressed, so it\nequals `rolled_back_to_version` once the retained payloads are restored)."
        },
        "resourcesRestored": {
          "type": "integer",
          "format": "int32",
          "description": "Number of resources re-published from the retained snapshot."
        }
      }
    },
    "v1Room": {
      "type": "object",
      "properties": {
        "roomId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:room_id;not null\""
        },
        "tenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:tenant_id;not null\""
        },
        "name": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:name;not null\""
        },
        "state": {
          "$ref": "#/definitions/v1RoomState",
          "title": "@inject_tag: gorm:\"column:state;not null;serializer:proto_enum\""
        },
        "maxParticipants": {
          "type": "integer",
          "format": "int32",
          "title": "@inject_tag: gorm:\"column:max_participants;not null\""
        },
        "participantCount": {
          "type": "integer",
          "format": "int32",
          "title": "@inject_tag: gorm:\"column:participant_count;not null\""
        },
        "config": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:config\""
        },
        "createdBy": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:created_by\""
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedBy": {
          "type": "string"
        }
      },
      "description": "Room: a WebRTC conferencing room."
    },
    "v1RoomState": {
      "type": "string",
      "enum": [
        "ROOM_STATE_UNSPECIFIED",
        "ROOM_STATE_ACTIVE",
        "ROOM_STATE_IDLE",
        "ROOM_STATE_CLOSED"
      ],
      "default": "ROOM_STATE_UNSPECIFIED"
    },
    "v1RotateApiKeyResponse": {
      "type": "object",
      "properties": {
        "key": {
          "$ref": "#/definitions/v1ApiKey"
        },
        "plainKey": {
          "type": "string",
          "description": "New plain key returned ONCE; the prior secret is invalidated immediately."
        },
        "previousKeyId": {
          "type": "string"
        }
      }
    },
    "v1RotateServiceAccountIdentityResponse": {
      "type": "object",
      "properties": {
        "grant": {
          "$ref": "#/definitions/v1ServiceAccountGrant"
        },
        "previousServiceIdentity": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1RotateTransitKeyRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        }
      }
    },
    "v1RotateTransitKeyResponse": {
      "type": "object",
      "properties": {
        "keyName": {
          "type": "string"
        },
        "version": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1SamlAcsResponse": {
      "type": "object",
      "properties": {
        "authenticated": {
          "type": "boolean"
        },
        "subject": {
          "type": "string",
          "title": "NameID"
        },
        "userId": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "emailVerified": {
          "type": "boolean"
        },
        "groups": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "roles granted via configured group mapping"
        },
        "assurance": {
          "$ref": "#/definitions/v1AssuranceLevel"
        },
        "signatureVerified": {
          "type": "boolean",
          "description": "True when the assertion signature could be verified; false + reason when the\nverification step is host-blocked (fail-closed: authenticated stays false)."
        },
        "detail": {
          "type": "string"
        },
        "attributesJson": {
          "type": "string",
          "description": "Mapped attributes for inspection (JSON object)."
        }
      }
    },
    "v1ScanResponse": {
      "type": "object",
      "properties": {
        "items": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1CacheItem"
          }
        },
        "nextPageToken": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1ScanVerdict": {
      "type": "string",
      "enum": [
        "SCAN_VERDICT_UNSPECIFIED",
        "SCAN_VERDICT_PENDING",
        "SCAN_VERDICT_CLEAN",
        "SCAN_VERDICT_INFECTED",
        "SCAN_VERDICT_FAILED"
      ],
      "default": "SCAN_VERDICT_UNSPECIFIED",
      "description": "Antivirus / content-scan verdict for a stored object (V050-3).\n\nUNSPECIFIED means NOT SCANNED, and is deliberately distinct from PENDING.\nRows that predate scanning carry it after upgrade, so an operator can tell\n\"no scanner has ever looked at this\" apart from \"a scan is in flight\" — and\nso enabling enforcement later is a decision, not a silent cutover.\n\n - SCAN_VERDICT_PENDING: A scan has been requested and has not yet returned.\n - SCAN_VERDICT_CLEAN: Scanned and found clean. The only verdict a gated download accepts.\n - SCAN_VERDICT_INFECTED: Scanned and found malicious. Refused on every download path regardless of\nwhether enforcement is enabled; only an explicit override scope can reach it.\n - SCAN_VERDICT_FAILED: The scanner ran and could not produce a verdict (timeout, unreadable\narchive, engine error). Not clean, and not proof of malice."
    },
    "v1ScheduleType": {
      "type": "string",
      "enum": [
        "SCHEDULE_TYPE_UNSPECIFIED",
        "SCHEDULE_TYPE_CRON",
        "SCHEDULE_TYPE_ONE_SHOT"
      ],
      "default": "SCHEDULE_TYPE_UNSPECIFIED",
      "description": "How a scheduled job's next fire time is derived.\n\n - SCHEDULE_TYPE_CRON: Recurring job; next_fire_at is advanced from the cron expression after each fire.\n - SCHEDULE_TYPE_ONE_SHOT: One-shot job; fires exactly once at next_fire_at, then transitions to COMPLETED."
    },
    "v1ScheduledJob": {
      "type": "object",
      "properties": {
        "jobId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:job_id;not null\""
        },
        "tenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:tenant_id;not null\""
        },
        "projectId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:project_id\""
        },
        "name": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:name;not null\""
        },
        "scheduleType": {
          "$ref": "#/definitions/v1ScheduleType",
          "title": "@inject_tag: gorm:\"column:schedule_type;not null;serializer:proto_enum\""
        },
        "cronExpression": {
          "type": "string",
          "description": "Cron expression for SCHEDULE_TYPE_CRON jobs (ignored for one-shot).\n\n@inject_tag: gorm:\"column:cron_expression\""
        },
        "payload": {
          "type": "string",
          "description": "Opaque JSON payload delivered verbatim with the fired event; the consumer\ninterprets it. The scheduler never executes it in-process.\n\n@inject_tag: gorm:\"column:payload\""
        },
        "targetTopic": {
          "type": "string",
          "description": "Informational topic the firing consumer is expected to listen on.\n\n@inject_tag: gorm:\"column:target_topic\""
        },
        "status": {
          "$ref": "#/definitions/v1JobStatus",
          "title": "@inject_tag: gorm:\"column:status;not null;serializer:proto_enum\""
        },
        "nextFireAt": {
          "type": "string",
          "format": "date-time",
          "description": "When the job is next eligible to fire. NULL once a one-shot job COMPLETED.\n\n@inject_tag: gorm:\"column:next_fire_at\""
        },
        "lastFiredAt": {
          "type": "string",
          "format": "date-time",
          "title": "@inject_tag: gorm:\"column:last_fired_at\""
        },
        "maxAttempts": {
          "type": "integer",
          "format": "int32",
          "description": "Maximum delivery attempts before the job is dead-lettered.\n\n@inject_tag: gorm:\"column:max_attempts;not null\""
        },
        "attemptCount": {
          "type": "integer",
          "format": "int32",
          "description": "Failed attempts since the last successful fire; reset to 0 on success.\n\n@inject_tag: gorm:\"column:attempt_count;not null\""
        },
        "backoffSeconds": {
          "type": "integer",
          "format": "int32",
          "description": "Base backoff (seconds) used to defer next_fire_at after a failed attempt.\n\n@inject_tag: gorm:\"column:backoff_seconds;not null\""
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedBy": {
          "type": "string"
        }
      },
      "description": "ScheduledJob — a durable cron or one-shot job. The leader-elected scheduler\ntick claims DUE rows with `FOR UPDATE SKIP LOCKED` and FIRES an outbox event\n(`udb.scheduler.job.fired.v1`); it never executes the payload in-process —\nconsumers do the work (at-least-once). After `max_attempts` failures a job is\nrouted to the dead-letter topic (`udb.scheduler.job.dead.v1`) and marked DEAD."
    },
    "v1ScimCreateGroupResponse": {
      "type": "object",
      "properties": {
        "group": {
          "$ref": "#/definitions/v1ScimGroup"
        }
      }
    },
    "v1ScimCreateUserResponse": {
      "type": "object",
      "properties": {
        "user": {
          "$ref": "#/definitions/v1ScimUser"
        }
      }
    },
    "v1ScimDeleteGroupResponse": {
      "type": "object",
      "properties": {
        "deleted": {
          "type": "boolean"
        }
      }
    },
    "v1ScimDeleteUserResponse": {
      "type": "object",
      "properties": {
        "deactivated": {
          "type": "boolean",
          "title": "mapped to deactivate + session revoke"
        }
      }
    },
    "v1ScimGetGroupResponse": {
      "type": "object",
      "properties": {
        "group": {
          "$ref": "#/definitions/v1ScimGroup"
        }
      }
    },
    "v1ScimGetUserResponse": {
      "type": "object",
      "properties": {
        "user": {
          "$ref": "#/definitions/v1ScimUser"
        }
      }
    },
    "v1ScimGroup": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "displayName": {
          "type": "string"
        },
        "members": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "member SCIM ids"
        },
        "rawJson": {
          "type": "string"
        }
      }
    },
    "v1ScimListGroupsResponse": {
      "type": "object",
      "properties": {
        "groups": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ScimGroup"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ScimListUsersResponse": {
      "type": "object",
      "properties": {
        "users": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ScimUser"
          }
        },
        "page": {
          "$ref": "#/definitions/v1PageResponse"
        }
      }
    },
    "v1ScimPatchGroupResponse": {
      "type": "object",
      "properties": {
        "group": {
          "$ref": "#/definitions/v1ScimGroup"
        },
        "grantedRoles": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Roles granted/revoked as a result of group membership changes (only via\nconfigured group→role mappings)."
        }
      }
    },
    "v1ScimPatchOp": {
      "type": "object",
      "properties": {
        "op": {
          "type": "string",
          "title": "add | replace | remove"
        },
        "path": {
          "type": "string",
          "title": "e.g. \"active\", \"members\""
        },
        "valueJson": {
          "type": "string",
          "title": "JSON-encoded value"
        }
      },
      "description": "SCIM PATCH operations (RFC 7644 §3.5.2): add/replace/remove on a path."
    },
    "v1ScimPatchUserResponse": {
      "type": "object",
      "properties": {
        "user": {
          "$ref": "#/definitions/v1ScimUser"
        }
      }
    },
    "v1ScimReplaceUserResponse": {
      "type": "object",
      "properties": {
        "user": {
          "$ref": "#/definitions/v1ScimUser"
        }
      }
    },
    "v1ScimUser": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "title": "SCIM id (== external_identity_id)"
        },
        "userName": {
          "type": "string",
          "title": "SCIM userName (subject)"
        },
        "displayName": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "active": {
          "type": "boolean"
        },
        "groups": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "rawJson": {
          "type": "string",
          "title": "full SCIM user JSON"
        }
      },
      "description": "A SCIM resource carried as its canonical JSON body. CRUD handlers persist\ninto the native external_identities / role-binding tables under the\nconfigured mappings; the JSON keeps full SCIM 2.0 schema fidelity for the\nconnector while the broker stays schema-agnostic."
    },
    "v1SealStatusResponse": {
      "type": "object",
      "properties": {
        "sealed": {
          "type": "boolean",
          "description": "True when the master key is unavailable; every other RPC fails closed."
        },
        "kekConfigured": {
          "type": "boolean",
          "description": "True when a real master KEK is configured (vs dev passthrough)."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1SearchHit": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "score": {
          "type": "number",
          "format": "double"
        },
        "indexName": {
          "type": "string"
        },
        "payloadJson": {
          "type": "string",
          "title": "JSON"
        }
      }
    },
    "v1SearchIndexSummary": {
      "type": "object",
      "properties": {
        "indexId": {
          "type": "string"
        },
        "indexName": {
          "type": "string"
        },
        "sourceMessageType": {
          "type": "string"
        },
        "backend": {
          "type": "string"
        },
        "resourceName": {
          "type": "string"
        },
        "vectorDims": {
          "type": "integer",
          "format": "int32"
        },
        "status": {
          "type": "string"
        }
      }
    },
    "v1SearchMode": {
      "type": "string",
      "enum": [
        "SEARCH_MODE_UNSPECIFIED",
        "SEARCH_MODE_TEXT",
        "SEARCH_MODE_VECTOR",
        "SEARCH_MODE_HYBRID"
      ],
      "default": "SEARCH_MODE_UNSPECIFIED",
      "description": "Query mode for a Search request.\n\n - SEARCH_MODE_TEXT: Lexical full-text only (requires query_text).\n - SEARCH_MODE_VECTOR: Dense-vector nearest-neighbour only (requires query_vector).\n - SEARCH_MODE_HYBRID: Hybrid lexical + vector fused with reciprocal-rank fusion."
    },
    "v1SearchRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "indexName": {
          "type": "string",
          "description": "Target a single index, or empty to fuse across all of the tenant's indexes."
        },
        "queryText": {
          "type": "string"
        },
        "queryVector": {
          "type": "array",
          "items": {
            "type": "number",
            "format": "float"
          }
        },
        "topK": {
          "type": "integer",
          "format": "int32"
        },
        "mode": {
          "$ref": "#/definitions/v1SearchMode"
        },
        "pageSize": {
          "type": "integer",
          "format": "int32",
          "description": "Requested page size. Defaults to top_k and is capped by the search max."
        },
        "pageToken": {
          "type": "string",
          "description": "Opaque pagination token returned by SearchResponse.next_page_token."
        }
      }
    },
    "v1SearchResponse": {
      "type": "object",
      "properties": {
        "hits": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1SearchHit"
          }
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "nextPageToken": {
          "type": "string",
          "description": "Opaque token for the next page; empty when no more hits are available."
        }
      }
    },
    "v1SecretSummary": {
      "type": "object",
      "properties": {
        "secretPath": {
          "type": "string",
          "description": "Canonical public resource name for the secret within the tenant vault."
        },
        "latestVersion": {
          "type": "integer",
          "format": "int32"
        },
        "state": {
          "type": "string"
        }
      },
      "description": "One secret path summary — metadata only, NEVER a value."
    },
    "v1SeedBuiltinRolesRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        }
      }
    },
    "v1SeedBuiltinRolesResponse": {
      "type": "object",
      "properties": {
        "seededRoleCodes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "created": {
          "type": "integer",
          "format": "int32"
        },
        "existing": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1SendNotificationRequest": {
      "type": "object",
      "properties": {
        "eventType": {
          "type": "string",
          "title": "Must match a template event_type"
        },
        "recipientId": {
          "type": "string"
        },
        "recipientAddress": {
          "type": "string",
          "title": "Resolved by caller or looked up in User service"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "resourceType": {
          "type": "string"
        },
        "resourceId": {
          "type": "string"
        },
        "resourceName": {
          "type": "string"
        },
        "correlationId": {
          "type": "string"
        },
        "locale": {
          "type": "string",
          "title": "Defaults to 'en'"
        },
        "variables": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "title": "Template variable substitutions"
        },
        "channels": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v1NotificationChannel"
          },
          "title": "Empty = use template-default channels"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1SendNotificationResponse": {
      "type": "object",
      "properties": {
        "logs": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1NotificationLog"
          }
        }
      }
    },
    "v1SendOTPRequest": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "otpType": {
          "$ref": "#/definitions/v1OTPType"
        },
        "correlationId": {
          "type": "string",
          "title": "correlation_id to link the OTP to an in-flight operation"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1SendOTPResponse": {
      "type": "object",
      "properties": {
        "otpId": {
          "type": "string"
        },
        "expiresInSeconds": {
          "type": "integer",
          "format": "int32"
        },
        "cooldownSeconds": {
          "type": "integer",
          "format": "int32",
          "title": "Wait before next resend"
        },
        "devOtpCode": {
          "type": "string",
          "description": "Dev-only echo of the plaintext OTP code, populated ONLY when the broker runs\nwith UDB_OTP_DEV_ECHO=1 (non-production posture). Empty in production. Lets\nconformance harnesses complete VerifyOTP/ResetPassword without a delivery\nchannel. bug_report.md F/Lane-2."
        }
      }
    },
    "v1SendPhoneVerificationResponse": {
      "type": "object",
      "properties": {
        "otpId": {
          "type": "string"
        },
        "devOtpCode": {
          "type": "string",
          "description": "Dev-only echo of the plaintext PHONE_VERIFICATION OTP code, populated ONLY when\nthe broker runs with UDB_OTP_DEV_ECHO=1 (non-production posture). Empty in\nproduction. Lets conformance harnesses complete VerifyOTP without an SMS\ndelivery channel. bug_report.md F/Lane-2."
        }
      }
    },
    "v1ServiceAccountGrant": {
      "type": "object",
      "properties": {
        "grantId": {
          "type": "string",
          "description": "Server-assigned UUID identifying this grant row."
        },
        "userId": {
          "type": "string",
          "description": "The owning service-account user (exactly one grant per account)."
        },
        "serviceIdentity": {
          "type": "string",
          "description": "The IMMUTABLE service identity (e.g. a SPIFFE URI or stable service name).\nUnique across the deployment; rotation is an explicit audited operation\nthat revokes dependent credentials, never an in-place edit."
        },
        "tenantId": {
          "type": "string",
          "description": "Same canonical tenant identifier type as authn User.tenant_id."
        },
        "projectId": {
          "type": "string"
        },
        "approvedScopesJson": {
          "type": "string",
          "description": "Operator-approved scopes (JSON array of strings). Admin/owner/wildcard\nscopes are rejected at write time; validation re-rejects on every read."
        },
        "status": {
          "type": "string",
          "description": "ACTIVE | REVOKED. Only ACTIVE grants authenticate."
        },
        "revision": {
          "type": "string",
          "format": "int64",
          "description": "Monotonic revision, incremented on every replace, so dependent credential\ncaches and certificate bindings can detect stale grants."
        },
        "updatedBy": {
          "type": "string",
          "description": "Audit provenance: the administrative principal and reason for the last\ncreate/replace/revoke."
        },
        "reason": {
          "type": "string"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "title": "---------------------------------------------------------------------------\nServiceAccountGrant — the TYPED, durable, operator-approved scope grant for a\nservice account (UDB-AUTH-003/006). Security policy no longer lives in the\nmutable free-form `users.profile_attributes_json`: a grant row is the single\nauthoritative source of a service account's immutable service identity,\ntenant/project binding, and approved scope set, consumed by password login,\nAPI-key creation/authentication, token refresh, and mTLS certificate\nbindings through ONE shared validation helper. Admin/owner/wildcard scopes\nare rejected at write time and again at every read (defense in depth).\nMutations require authn administrative scopes and produce durable audit\nevents; `revision` increments on every replace so dependent credentials can\ndetect stale grants.\n---------------------------------------------------------------------------"
    },
    "v1Session": {
      "type": "object",
      "properties": {
        "sessionId": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        },
        "sessionType": {
          "$ref": "#/definitions/v1SessionType"
        },
        "sessionTokenLookup": {
          "type": "string",
          "description": "── SERVER-SIDE fields ──────────────────────────────────────────────────\nKeyed lookup digest of the opaque session token (for fast index lookup)."
        },
        "sessionTokenHash": {
          "type": "string",
          "description": "Keyed HMAC digest of the session token (for secure verify after lookup)."
        },
        "csrfTokenHash": {
          "type": "string",
          "description": "CSRF token hash (double-submit cookie pattern)."
        },
        "accessTokenJti": {
          "type": "string",
          "description": "── JWT fields ──────────────────────────────────────────────────────────\nJWT ID of the currently-valid access token (for revocation check)."
        },
        "refreshTokenJti": {
          "type": "string"
        },
        "deviceType": {
          "$ref": "#/definitions/v1DeviceType",
          "title": "── Common fields ───────────────────────────────────────────────────────"
        },
        "deviceName": {
          "type": "string"
        },
        "ipAddress": {
          "type": "string"
        },
        "userAgent": {
          "type": "string"
        },
        "isActive": {
          "type": "boolean"
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time"
        },
        "lastActiveAt": {
          "type": "string",
          "format": "date-time"
        },
        "revokedBy": {
          "type": "string"
        },
        "revokeReason": {
          "type": "string"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "principalId": {
          "type": "string"
        },
        "providerId": {
          "type": "string"
        },
        "authMethod": {
          "type": "string"
        },
        "scopesJson": {
          "type": "string"
        },
        "metadataJson": {
          "type": "string"
        }
      },
      "description": "---------------------------------------------------------------------------\nSession — Authenticated session for a user, service account, workload, or\nexternal identity mapped into UDB.\n\nHybrid model:\n  SERVER_SIDE: cookie-based; session_token_lookup (keyed HMAC) → hash verify\n  JWT:         access_token_jti + refresh_token_jti tracked for revocation\n\nMigration order 2. RLS scopes rows to the current tenant.\n---------------------------------------------------------------------------"
    },
    "v1SessionType": {
      "type": "string",
      "enum": [
        "SESSION_TYPE_UNSPECIFIED",
        "SESSION_TYPE_SERVER_SIDE",
        "SESSION_TYPE_JWT",
        "SESSION_TYPE_API_KEY",
        "SESSION_TYPE_MTLS",
        "SESSION_TYPE_EXTERNAL"
      ],
      "default": "SESSION_TYPE_UNSPECIFIED",
      "description": " - SESSION_TYPE_SERVER_SIDE: Cookie + CSRF token.\n - SESSION_TYPE_JWT: Access + refresh JWT."
    },
    "v1SetModelStatusRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "modelId": {
          "type": "string"
        },
        "status": {
          "$ref": "#/definitions/v1EmbeddingModelStatus"
        },
        "replacementModelId": {
          "type": "string"
        },
        "retireAfterUnixMs": {
          "type": "string",
          "format": "int64"
        },
        "tenantState": {
          "$ref": "#/definitions/v1EmbeddingTenantState"
        }
      }
    },
    "v1SetModelStatusResponse": {
      "type": "object",
      "properties": {
        "updated": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        },
        "tenantState": {
          "$ref": "#/definitions/v1EmbeddingTenantState"
        }
      }
    },
    "v1SetPreferenceResponse": {
      "type": "object",
      "properties": {
        "preference": {
          "$ref": "#/definitions/v1NotificationPreference"
        }
      }
    },
    "v1SetResponse": {
      "type": "object",
      "properties": {
        "stored": {
          "type": "boolean"
        },
        "usedBytes": {
          "type": "string",
          "format": "int64"
        },
        "maxBytes": {
          "type": "string",
          "format": "int64"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1SetScanVerdictResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "verdict": {
          "$ref": "#/definitions/v1ScanVerdict",
          "description": "The verdict now stored, after the transition rules were applied."
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1SignRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        },
        "input": {
          "type": "string"
        }
      }
    },
    "v1SignResponse": {
      "type": "object",
      "properties": {
        "signature": {
          "type": "string"
        },
        "keyVersion": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1SignalWorkflowResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1SignedPolicyBundle": {
      "type": "object",
      "properties": {
        "bundle": {
          "type": "string",
          "format": "byte",
          "description": "Serialized snapshot payload (canonical JSON). Opaque to transport."
        },
        "signature": {
          "type": "string",
          "description": "Base64 signature over `bundle`."
        },
        "keyId": {
          "type": "string",
          "description": "Identifier of the signing key so callers can rotate/verify."
        },
        "algorithm": {
          "type": "string",
          "description": "Signature algorithm, e.g. \"HMAC-SHA256\"."
        },
        "policyVersion": {
          "type": "string"
        },
        "relationshipVersion": {
          "type": "string"
        },
        "issuedAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "ttlSeconds": {
          "type": "string",
          "format": "uint64"
        }
      }
    },
    "v1SimulatePolicyRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "draftId": {
          "type": "string",
          "description": "Draft to evaluate the candidate decision against (its document is loaded\nin-memory). Empty + candidate set = simulate an ad-hoc document."
        },
        "candidate": {
          "$ref": "#/definitions/v1PolicyDocument",
          "description": "Candidate authz inputs evaluated in-memory WITHOUT mutating durable state."
        },
        "cases": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1SimulationCase"
          },
          "description": "One or more cases to evaluate (single + batch share one shape)."
        },
        "persist": {
          "type": "boolean",
          "description": "Persist a PolicySimulation row per case (impact-analysis record)."
        },
        "policyVersionId": {
          "type": "string",
          "description": "Optional draft version id to stamp on persisted PolicySimulation rows."
        }
      }
    },
    "v1SimulatePolicyResponse": {
      "type": "object",
      "properties": {
        "results": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1SimulationResult"
          }
        },
        "diffJson": {
          "type": "string",
          "description": "Aggregate machine-readable diff over all cases."
        }
      }
    },
    "v1SimulationCase": {
      "type": "object",
      "properties": {
        "principal": {
          "$ref": "#/definitions/coreAuthzServicesV1Principal"
        },
        "resource": {
          "$ref": "#/definitions/v1ResourceRef"
        },
        "action": {
          "type": "string"
        },
        "purpose": {
          "type": "string"
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "label": {
          "type": "string",
          "description": "Optional label echoed in the result for batch correlation."
        }
      }
    },
    "v1SimulationResult": {
      "type": "object",
      "properties": {
        "label": {
          "type": "string"
        },
        "activeDecision": {
          "$ref": "#/definitions/v1Decision"
        },
        "draftDecision": {
          "$ref": "#/definitions/v1Decision"
        },
        "changed": {
          "type": "boolean",
          "description": "True when active and draft decisions differ on `allowed`."
        },
        "diffJson": {
          "type": "string"
        }
      }
    },
    "v1SlaComplianceEntry": {
      "type": "object",
      "properties": {
        "stageName": {
          "type": "string"
        },
        "period": {
          "type": "string"
        },
        "p99LatencyMs": {
          "type": "number",
          "format": "double"
        },
        "errorRate": {
          "type": "number",
          "format": "double"
        },
        "p99SlaMet": {
          "type": "boolean"
        },
        "errorRateSlaMet": {
          "type": "boolean"
        }
      }
    },
    "v1StartPipelineRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "definitionId": {
          "type": "string"
        },
        "assetId": {
          "type": "string"
        },
        "context": {
          "type": "string",
          "title": "JSON"
        },
        "correlationId": {
          "type": "string"
        }
      }
    },
    "v1StartPipelineResponse": {
      "type": "object",
      "properties": {
        "instanceId": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        },
        "steps": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PipelineStep"
          }
        }
      }
    },
    "v1StartRoomCompositeResponse": {
      "type": "object",
      "properties": {
        "egressId": {
          "type": "string",
          "description": "Server-derived, tenant-scoped egress identifier."
        },
        "status": {
          "$ref": "#/definitions/v1EgressStatus"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "description": "Error information if operation failed."
        }
      }
    },
    "v1StartSamlLoginResponse": {
      "type": "object",
      "properties": {
        "redirectUrl": {
          "type": "string",
          "description": "Full redirect URL (SSO endpoint with SAMLRequest + optional Signature)."
        },
        "samlRequest": {
          "type": "string",
          "description": "Base64 deflate-encoded AuthnRequest."
        },
        "requestId": {
          "type": "string"
        },
        "signed": {
          "type": "boolean"
        }
      }
    },
    "v1StartTenantBackupRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected."
        },
        "policyName": {
          "type": "string",
          "description": "Optional policy name whose object backend/bucket are used when set."
        },
        "objectBackend": {
          "type": "string",
          "description": "Optional object-store overrides; fall back to the policy or service default."
        },
        "objectBucket": {
          "type": "string"
        },
        "metadataJson": {
          "type": "string"
        }
      }
    },
    "v1StartTenantBackupResponse": {
      "type": "object",
      "properties": {
        "backupId": {
          "type": "string"
        },
        "objectPrefix": {
          "type": "string"
        },
        "manifestChecksum": {
          "type": "string"
        },
        "tableCount": {
          "type": "integer",
          "format": "int32"
        },
        "totalRows": {
          "type": "string",
          "format": "int64"
        },
        "excludedCount": {
          "type": "integer",
          "format": "int32"
        },
        "tables": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1BackupTableEntry"
          }
        },
        "excluded": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1BackupExcludedTable"
          }
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1StartTrackEgressResponse": {
      "type": "object",
      "properties": {
        "egressId": {
          "type": "string"
        },
        "status": {
          "$ref": "#/definitions/v1EgressStatus"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "description": "Error information if operation failed."
        }
      }
    },
    "v1StartWebAuthnAuthenticationRequest": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1StartWebAuthnAuthenticationResponse": {
      "type": "object",
      "properties": {
        "challengeId": {
          "type": "string"
        },
        "publicKeyCredentialRequestOptionsJson": {
          "type": "string"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1StartWebAuthnRegistrationResponse": {
      "type": "object",
      "properties": {
        "challengeId": {
          "type": "string"
        },
        "publicKeyCredentialCreationOptionsJson": {
          "type": "string"
        },
        "expiresAtUnix": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1StartWorkflowRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected."
        },
        "projectId": {
          "type": "string"
        },
        "workflowType": {
          "type": "string",
          "description": "Application workflow type (the discriminator)."
        },
        "totalSteps": {
          "type": "integer",
          "format": "int32",
          "description": "Number of forward steps (clamped to the service's bounds)."
        },
        "payload": {
          "type": "string",
          "description": "Opaque JSON payload delivered with every transition event."
        },
        "compensations": {
          "type": "string",
          "description": "Reverse-order compensation payloads (JSON array) handed to the saga engine."
        },
        "correlationId": {
          "type": "string"
        }
      }
    },
    "v1StartWorkflowResponse": {
      "type": "object",
      "properties": {
        "workflowId": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1StepStatus": {
      "type": "string",
      "enum": [
        "STEP_STATUS_UNSPECIFIED",
        "STEP_STATUS_PENDING",
        "STEP_STATUS_RUNNING",
        "STEP_STATUS_COMPLETED",
        "STEP_STATUS_SKIPPED",
        "STEP_STATUS_FAILED"
      ],
      "default": "STEP_STATUS_UNSPECIFIED"
    },
    "v1StepType": {
      "type": "string",
      "enum": [
        "STEP_TYPE_UNSPECIFIED",
        "STEP_TYPE_EMBED",
        "STEP_TYPE_THUMBNAIL",
        "STEP_TYPE_RESIZE",
        "STEP_TYPE_TRANSCODE",
        "STEP_TYPE_CAPTION",
        "STEP_TYPE_EXTRACT"
      ],
      "default": "STEP_TYPE_UNSPECIFIED"
    },
    "v1StopEgressResponse": {
      "type": "object",
      "properties": {
        "egressId": {
          "type": "string"
        },
        "status": {
          "$ref": "#/definitions/v1EgressStatus"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "description": "Error information if operation failed."
        }
      }
    },
    "v1SubmitPolicyDraftRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "draftId": {
          "type": "string"
        },
        "expectedUpdatedAtUnix": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1SubscribeRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Verified against the bearer/claim tenant; cross-tenant values are rejected."
        },
        "messageType": {
          "type": "string",
          "description": "Fully-qualified source proto message type, e.g.\n\"udb.core.lock.entity.v1.Lock\". Must declare a tenant-isolation column."
        },
        "filters": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1LiveQueryPredicate"
          },
          "description": "IR-expressible filter: the predicates are AND-ed together. The server-side\ntenant predicate is always injected on top of these."
        },
        "projectId": {
          "type": "string",
          "description": "Optional project scope; further narrows the tenant predicate."
        },
        "snapshotLimit": {
          "type": "integer",
          "format": "int32",
          "description": "Upper bound on rows returned in the initial snapshot (clamped server-side)."
        }
      }
    },
    "v1SubscribeResponse": {
      "type": "object",
      "properties": {
        "snapshot": {
          "$ref": "#/definitions/v1LiveQuerySnapshot"
        },
        "change": {
          "$ref": "#/definitions/v1LiveQueryChange"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "description": "Error information if the stream is terminating abnormally."
        }
      },
      "description": "One streamed frame: either the initial snapshot or a single change delta."
    },
    "v1Tenant": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:tenant_id;not null\""
        },
        "code": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:code;not null\""
        },
        "name": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:name;not null\""
        },
        "type": {
          "$ref": "#/definitions/v1TenantType",
          "title": "@inject_tag: gorm:\"column:type;not null;serializer:proto_enum\""
        },
        "status": {
          "$ref": "#/definitions/v1TenantStatus",
          "title": "@inject_tag: gorm:\"column:status;not null;serializer:proto_enum\""
        },
        "parentTenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:parent_tenant_id\""
        },
        "config": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:config\""
        },
        "branding": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:branding\""
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        },
        "deletedBy": {
          "type": "string"
        }
      },
      "title": "Tenant (FR-016)"
    },
    "v1TenantConfig": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:config_id;not null\""
        },
        "tenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:tenant_id;not null\""
        },
        "configKey": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:config_key;not null\""
        },
        "configValue": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:config_value;not null\""
        },
        "type": {
          "$ref": "#/definitions/v1ConfigType",
          "title": "@inject_tag: gorm:\"column:type;not null;serializer:proto_enum\""
        },
        "description": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:description\""
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        }
      },
      "title": "Tenant configuration"
    },
    "v1TenantContext": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "description": "Tenant or account boundary chosen by the caller or resolved by UDB."
        },
        "organizationId": {
          "type": "string",
          "description": "Optional owning organization/workspace above the tenant boundary."
        },
        "projectId": {
          "type": "string",
          "description": "Project/application namespace inside the tenant."
        },
        "environment": {
          "type": "string",
          "description": "Deployment environment, for example prod, staging, dev, or test."
        },
        "region": {
          "type": "string",
          "description": "Region, shard, or residency boundary when routing matters."
        },
        "partitionId": {
          "type": "string",
          "description": "Optional data partition or workspace identifier for fine-grained isolation."
        },
        "accessSurface": {
          "type": "string",
          "description": "UI/API surface or workload channel such as web, mobile, api, worker."
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Consumer-defined labels for policy routing and audit enrichment."
        }
      }
    },
    "v1TenantStatus": {
      "type": "string",
      "enum": [
        "TENANT_STATUS_UNSPECIFIED",
        "TENANT_STATUS_ACTIVE",
        "TENANT_STATUS_SUSPENDED",
        "TENANT_STATUS_INACTIVE"
      ],
      "default": "TENANT_STATUS_UNSPECIFIED"
    },
    "v1TenantType": {
      "type": "string",
      "enum": [
        "TENANT_TYPE_UNSPECIFIED",
        "TENANT_TYPE_PLATFORM",
        "TENANT_TYPE_PARTNER",
        "TENANT_TYPE_ORGANIZATION",
        "TENANT_TYPE_WORKSPACE",
        "TENANT_TYPE_CUSTOMER_ACCOUNT",
        "TENANT_TYPE_DEPARTMENT",
        "TENANT_TYPE_SANDBOX"
      ],
      "default": "TENANT_TYPE_UNSPECIFIED"
    },
    "v1TestProviderDiscoveryResponse": {
      "type": "object",
      "properties": {
        "reachable": {
          "type": "boolean"
        },
        "health": {
          "$ref": "#/definitions/v1ProviderHealth"
        },
        "resolvedIssuer": {
          "type": "string"
        },
        "resolvedJwksUrl": {
          "type": "string"
        },
        "keyCount": {
          "type": "integer",
          "format": "int32"
        },
        "keyIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "JWKS kid list / SAML cert fingerprints"
        },
        "detail": {
          "type": "string"
        }
      }
    },
    "v1TokenType": {
      "type": "string",
      "enum": [
        "TOKEN_TYPE_UNSPECIFIED",
        "TOKEN_TYPE_JWT_ACCESS",
        "TOKEN_TYPE_JWT_REFRESH",
        "TOKEN_TYPE_SESSION",
        "TOKEN_TYPE_API_KEY",
        "TOKEN_TYPE_EXTERNAL"
      ],
      "default": "TOKEN_TYPE_UNSPECIFIED"
    },
    "v1Track": {
      "type": "object",
      "properties": {
        "trackId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"primaryKey;column:track_id;not null\""
        },
        "roomId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:room_id;not null\""
        },
        "peerId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:peer_id;not null\""
        },
        "tenantId": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:tenant_id;not null\""
        },
        "kind": {
          "$ref": "#/definitions/v1TrackKind",
          "title": "@inject_tag: gorm:\"column:kind;not null;serializer:proto_enum\""
        },
        "label": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:label\""
        },
        "state": {
          "$ref": "#/definitions/v1TrackState",
          "title": "@inject_tag: gorm:\"column:state;not null;serializer:proto_enum\""
        },
        "settings": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:settings\""
        },
        "metadata": {
          "type": "string",
          "title": "@inject_tag: gorm:\"column:metadata\""
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo",
          "title": "@inject_tag: gorm:\"column:audit_info;not null\""
        }
      },
      "description": "Track: a media or data track published by a peer."
    },
    "v1TrackKind": {
      "type": "string",
      "enum": [
        "TRACK_KIND_UNSPECIFIED",
        "TRACK_KIND_AUDIO",
        "TRACK_KIND_VIDEO",
        "TRACK_KIND_SCREEN",
        "TRACK_KIND_DATA"
      ],
      "default": "TRACK_KIND_UNSPECIFIED"
    },
    "v1TrackState": {
      "type": "string",
      "enum": [
        "TRACK_STATE_UNSPECIFIED",
        "TRACK_STATE_ACTIVE",
        "TRACK_STATE_MUTED",
        "TRACK_STATE_ENDED"
      ],
      "default": "TRACK_STATE_UNSPECIFIED"
    },
    "v1TransferServiceAccountGrantResponse": {
      "type": "object",
      "properties": {
        "grant": {
          "$ref": "#/definitions/v1ServiceAccountGrant",
          "description": "The grant after the transfer: now owned by to_user_id with its revision\nbumped. Its service_identity and approved scopes are unchanged."
        },
        "previousUserId": {
          "type": "string",
          "description": "The account that previously held the grant — feed it back as to_user_id\n(with the new revision) for a deterministic reverse transfer."
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1TransitPublicKey": {
      "type": "object",
      "properties": {
        "version": {
          "type": "integer",
          "format": "int32"
        },
        "publicKey": {
          "type": "string"
        },
        "state": {
          "type": "string"
        }
      },
      "description": "One usable version's Ed25519 public key. The public key is NOT secret."
    },
    "v1TriggerSnapshotRequest": {
      "type": "object",
      "properties": {
        "stageName": {
          "type": "string",
          "title": "Empty = all stages"
        },
        "hour": {
          "type": "string",
          "title": "ISO 8601 hour; empty = previous complete hour"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1TriggerSnapshotResponse": {
      "type": "object",
      "properties": {
        "snapshotsWritten": {
          "type": "integer",
          "format": "int32"
        }
      }
    },
    "v1UndeleteSecretRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "secretPath": {
          "type": "string"
        }
      }
    },
    "v1UndeleteSecretResponse": {
      "type": "object",
      "properties": {
        "secretPath": {
          "type": "string"
        },
        "version": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1UnlinkIdentityResponse": {
      "type": "object",
      "properties": {
        "unlinked": {
          "type": "boolean"
        }
      }
    },
    "v1UnpublishTrackResponse": {
      "type": "object",
      "properties": {
        "success": {
          "type": "boolean"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1UpdateApiKeyResponse": {
      "type": "object",
      "properties": {
        "key": {
          "$ref": "#/definitions/v1ApiKey"
        }
      }
    },
    "v1UpdateEndpointResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1UpdateFileResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1UpdatePolicyDraftRequest": {
      "type": "object",
      "properties": {
        "actor": {
          "$ref": "#/definitions/v1GovernanceActor"
        },
        "draftId": {
          "type": "string"
        },
        "document": {
          "$ref": "#/definitions/v1PolicyDocument"
        },
        "changeReason": {
          "type": "string"
        },
        "expectedUpdatedAtUnix": {
          "type": "string",
          "format": "int64",
          "description": "Optimistic concurrency: must equal the draft's current updated_at epoch."
        },
        "highRisk": {
          "type": "boolean"
        },
        "title": {
          "type": "string"
        }
      }
    },
    "v1UpdateProviderResponse": {
      "type": "object",
      "properties": {
        "provider": {
          "$ref": "#/definitions/v1IdentityProvider"
        }
      }
    },
    "v1UpdateRoleResponse": {
      "type": "object",
      "properties": {
        "role": {
          "$ref": "#/definitions/v1Role"
        }
      }
    },
    "v1UpdateRoomResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1UpdateTenantConfigResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1UpdateTenantResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError",
          "title": "Error information if operation failed"
        }
      }
    },
    "v1UpdateUserResponse": {
      "type": "object",
      "properties": {
        "user": {
          "$ref": "#/definitions/v1User"
        }
      }
    },
    "v1UpsertTemplateResponse": {
      "type": "object",
      "properties": {
        "template": {
          "$ref": "#/definitions/v1NotificationTemplate"
        }
      }
    },
    "v1User": {
      "type": "object",
      "properties": {
        "userId": {
          "type": "string"
        },
        "username": {
          "type": "string"
        },
        "email": {
          "type": "string",
          "title": "SCIM-2 (bug_report.md G): email stays NOT NULL (always a value, maybe '');\nthe column-level `unique` is dropped and uniqueness is enforced by the\nTABLE-level PARTIAL unique index `idx_users_email` (WHERE email <> '')\ndeclared in the pg_table option above — so email-less SCIM users don't\ncollide. (The column's singular `index` is intentionally NOT used: the\ndescriptor decode drops its where_clause.)"
        },
        "passwordHash": {
          "type": "string"
        },
        "accountKind": {
          "$ref": "#/definitions/v1AccountKind"
        },
        "status": {
          "$ref": "#/definitions/v1UserStatus"
        },
        "tenantId": {
          "type": "string"
        },
        "fullName": {
          "type": "string"
        },
        "totpSecretEnc": {
          "type": "string",
          "title": "MFA: totp_secret populated only when MFA is enrolled (TOTP authenticator app)"
        },
        "mfaEnabled": {
          "type": "boolean"
        },
        "failedLoginCount": {
          "type": "integer",
          "format": "int32",
          "title": "Failed login tracking"
        },
        "lockedUntil": {
          "type": "string",
          "format": "date-time"
        },
        "emailVerifiedAt": {
          "type": "string",
          "format": "date-time"
        },
        "lastLoginAt": {
          "type": "string",
          "format": "date-time"
        },
        "createdBy": {
          "type": "string"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedBy": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "externalProviderId": {
          "type": "string"
        },
        "externalSubject": {
          "type": "string"
        },
        "locale": {
          "type": "string"
        },
        "timezone": {
          "type": "string"
        },
        "profileAttributesJson": {
          "type": "string"
        },
        "externalReferencesJson": {
          "type": "string"
        },
        "phone": {
          "type": "string"
        },
        "phoneVerifiedAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "description": "---------------------------------------------------------------------------\nUser — a human, service, workload, or externally-mapped account that can be\nauthenticated by UDB and authorized by the UDB policy engine.\n\nMigration order 1 in schema udb_authn.\nThe password_hash uses Argon2id PHC strings; legacy keyed-HMAC values are upgraded on login.\nAll PII fields are masked in application logs via (pii) + (log_masked).\n---------------------------------------------------------------------------"
    },
    "v1UserRole": {
      "type": "object",
      "properties": {
        "userRoleId": {
          "type": "string"
        },
        "userId": {
          "type": "string"
        },
        "roleId": {
          "type": "string"
        },
        "domain": {
          "type": "string"
        },
        "assignedBy": {
          "type": "string"
        },
        "assignedAt": {
          "type": "string",
          "format": "date-time"
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time"
        },
        "createdBy": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        }
      },
      "description": "User-to-role assignment scoped by an authorization domain such as\ntenant:tenant_a, project:project_a, or resource:invoice/123."
    },
    "v1UserStatus": {
      "type": "string",
      "enum": [
        "USER_STATUS_UNSPECIFIED",
        "USER_STATUS_PENDING_VERIFICATION",
        "USER_STATUS_ACTIVE",
        "USER_STATUS_SUSPENDED",
        "USER_STATUS_LOCKED",
        "USER_STATUS_DEACTIVATED"
      ],
      "default": "USER_STATUS_UNSPECIFIED",
      "title": "- USER_STATUS_PENDING_VERIFICATION: Email not yet verified\n - USER_STATUS_SUSPENDED: Temporarily suspended by admin\n - USER_STATUS_LOCKED: Locked after repeated failed logins\n - USER_STATUS_DEACTIVATED: Permanently deactivated"
    },
    "v1ValidateApiKeyRequest": {
      "type": "object",
      "properties": {
        "plainKey": {
          "type": "string",
          "title": "Raw key from Authorization header"
        },
        "endpoint": {
          "type": "string",
          "title": "gRPC method or HTTP path being accessed"
        },
        "requiredScope": {
          "type": "string",
          "title": "e.g. \"resource:write\""
        },
        "ipAddress": {
          "type": "string",
          "title": "source IP for allowlist check"
        }
      }
    },
    "v1ValidateApiKeyResponse": {
      "type": "object",
      "properties": {
        "valid": {
          "type": "boolean"
        },
        "keyId": {
          "type": "string"
        },
        "ownerId": {
          "type": "string"
        },
        "ownerType": {
          "$ref": "#/definitions/v1ApiKeyOwnerType"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "Granted scopes list (caller checks required_scope membership)"
        },
        "rateLimited": {
          "type": "boolean"
        }
      }
    },
    "v1ValidateCSRFRequest": {
      "type": "object",
      "properties": {
        "sessionId": {
          "type": "string"
        },
        "csrfToken": {
          "type": "string",
          "title": "value from the csrf cookie / header"
        }
      }
    },
    "v1ValidateCSRFResponse": {
      "type": "object",
      "properties": {
        "valid": {
          "type": "boolean"
        }
      }
    },
    "v1ValidateTokenRequest": {
      "type": "object",
      "properties": {
        "token": {
          "type": "string",
          "title": "raw JWT or session_token"
        },
        "tokenType": {
          "$ref": "#/definitions/v1TokenType"
        }
      }
    },
    "v1ValidateTokenResponse": {
      "type": "object",
      "properties": {
        "valid": {
          "type": "boolean"
        },
        "userId": {
          "type": "string"
        },
        "sessionId": {
          "type": "string"
        },
        "accountKind": {
          "$ref": "#/definitions/v1AccountKind"
        },
        "tenantId": {
          "type": "string"
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "Resolved roles (from authz domain)"
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time"
        },
        "accessSurface": {
          "type": "string"
        },
        "deviceId": {
          "type": "string",
          "title": "device fingerprint (JWT sessions only)"
        },
        "tokenId": {
          "type": "string",
          "title": "JWT jti (JWT sessions) or session_token SHA256 prefix"
        },
        "sessionType": {
          "$ref": "#/definitions/v1SessionType"
        },
        "principal": {
          "$ref": "#/definitions/coreAuthnServicesV1Principal"
        },
        "projectId": {
          "type": "string"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "attributes": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "v1VerifyMfaChallengeRequest": {
      "type": "object",
      "properties": {
        "challengeId": {
          "type": "string"
        },
        "code": {
          "type": "string",
          "title": "TOTP / OTP / recovery code proof"
        },
        "deviceFingerprint": {
          "type": "string"
        },
        "context": {
          "$ref": "#/definitions/coreCommonV1RequestContext"
        }
      }
    },
    "v1VerifyMfaChallengeResponse": {
      "type": "object",
      "properties": {
        "verified": {
          "type": "boolean"
        },
        "userId": {
          "type": "string"
        }
      }
    },
    "v1VerifyOTPRequest": {
      "type": "object",
      "properties": {
        "otpId": {
          "type": "string"
        },
        "code": {
          "type": "string",
          "title": "Plain 6-digit code (transmitted over TLS; hashed server-side)"
        }
      }
    },
    "v1VerifyOTPResponse": {
      "type": "object",
      "properties": {
        "verified": {
          "type": "boolean"
        },
        "userId": {
          "type": "string"
        },
        "otpType": {
          "$ref": "#/definitions/v1OTPType"
        }
      }
    },
    "v1VerifyRequest": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string"
        },
        "keyName": {
          "type": "string"
        },
        "input": {
          "type": "string"
        },
        "signature": {
          "type": "string"
        }
      }
    },
    "v1VerifyResponse": {
      "type": "object",
      "properties": {
        "valid": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        },
        "error": {
          "$ref": "#/definitions/v1ApiError"
        }
      }
    },
    "v1WebAuthnCredentialSummary": {
      "type": "object",
      "properties": {
        "credentialId": {
          "type": "string"
        },
        "label": {
          "type": "string"
        },
        "createdAtUnix": {
          "type": "string",
          "format": "int64"
        },
        "lastUsedAtUnix": {
          "type": "string",
          "format": "int64"
        }
      }
    },
    "v1WebhookDelivery": {
      "type": "object",
      "properties": {
        "deliveryId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "endpointId": {
          "type": "string"
        },
        "eventId": {
          "type": "string",
          "description": "The source event id (outbox event_id) this delivery carried; lets a consumer\nde-duplicate at-least-once redeliveries."
        },
        "topic": {
          "type": "string",
          "description": "The topic the delivered event arrived on."
        },
        "status": {
          "type": "string",
          "description": "PENDING | DELIVERED | FAILED | DEAD."
        },
        "attemptCount": {
          "type": "integer",
          "format": "int32"
        },
        "responseStatus": {
          "type": "integer",
          "format": "int32",
          "description": "The last HTTP response status code observed (0 when the request never\ncompleted, e.g. a connection/SSRF-guard failure)."
        },
        "signature": {
          "type": "string",
          "description": "The `X-Udb-Signature` header value sent with the (last) attempt."
        },
        "lastError": {
          "type": "string",
          "description": "The last failure reason (empty on success)."
        },
        "payloadJson": {
          "type": "string",
          "description": "The delivered event body (the exact bytes the signature was computed over)."
        },
        "deliveredAt": {
          "type": "string",
          "format": "date-time"
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo"
        }
      },
      "title": "---------------------------------------------------------------------------\nWebhookDelivery — the durable, tenant-scoped delivery journal (master-plan\n9.4). One row per delivery attempt-run of one event to one endpoint: it\nrecords the outcome (PENDING | DELIVERED | FAILED | DEAD), the attempt count,\nthe last HTTP response status / error, and the `X-Udb-Signature` that was\nsent, so an operator can audit exactly what was delivered where and why a\ndelivery dead-lettered. RLS scopes rows to the current tenant.\n---------------------------------------------------------------------------"
    },
    "v1WebhookEndpoint": {
      "type": "object",
      "properties": {
        "endpointId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "url": {
          "type": "string",
          "description": "The external HTTPS delivery target. Validated by the SSRF guard at WRITE\ntime and again (DNS rebinding) at DELIVERY time: https-only, never a host\nresolving to a private/loopback/link-local/CGNAT range."
        },
        "topicPattern": {
          "type": "string",
          "description": "Topic subscription pattern (`*`, `udb.*`, or an exact topic). Selects which\ntopics reach this endpoint; delivery is still tenant-bound to `tenant_id`."
        },
        "signingSecret": {
          "type": "string",
          "description": "Per-endpoint HMAC signing secret. STORAGE_ONLY: never surfaced by the\ngenerated read/redaction layer (returned once at creation, like an API key)."
        },
        "active": {
          "type": "boolean",
          "description": "When false the endpoint is paused: no events are delivered to it."
        },
        "description": {
          "type": "string",
          "description": "Human-readable label for the endpoint."
        },
        "maxAttempts": {
          "type": "integer",
          "format": "int32",
          "description": "Maximum delivery attempts before a delivery is dead-lettered\n(`udb.webhook.delivery.dead.v1`) and journaled DEAD."
        },
        "metadataJson": {
          "type": "string"
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedBy": {
          "type": "string"
        }
      },
      "title": "---------------------------------------------------------------------------\nWebhookEndpoint — a per-tenant external HTTP delivery target (master-plan\n9.4). The broker delivers tenant-scoped domain events (CDC/outbox) to the\noutside world by POSTing the event body to `url`, signed with the\nper-endpoint `signing_secret` (HMAC-SHA256 → `X-Udb-Signature`). The\nsubscription `topic_pattern` selects which topics this endpoint receives, but\ndelivery is ALWAYS bound to this row's `tenant_id` (never pattern-only): an\nevent is delivered only when its payload tenant matches `tenant_id`, so a\ntenant can never subscribe to another tenant's events. RLS scopes rows to the\ncurrent tenant. The signing secret is OUTPUT_VIEW_STORAGE_ONLY — it is\nreturned exactly once at creation and never surfaced by the read layer again.\n---------------------------------------------------------------------------"
    },
    "v1WorkflowInstance": {
      "type": "object",
      "properties": {
        "workflowId": {
          "type": "string"
        },
        "tenantId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "workflowType": {
          "type": "string",
          "description": "Application-defined workflow type (the workflow/saga_kind discriminator). The\nengine maps every instance to `saga::SagaKind::Workflow` so the recorded saga\nrow is distinguishable from a plain data-plane saga; the DEFAULT kind is the\npre-9.12 data-plane saga whose behavior is unchanged."
        },
        "status": {
          "$ref": "#/definitions/v1WorkflowStatus"
        },
        "currentStep": {
          "type": "integer",
          "format": "int32",
          "description": "Steps advanced so far; advanced by one per tick until it reaches total_steps."
        },
        "totalSteps": {
          "type": "integer",
          "format": "int32",
          "description": "Total forward steps in this workflow (bounded; see MAX_WORKFLOW_STEPS)."
        },
        "payload": {
          "type": "string",
          "description": "Opaque JSON payload carried verbatim with every fired transition event; the\nconsumer interprets it. The workflow tick never executes it in-process."
        },
        "compensations": {
          "type": "string",
          "description": "Reverse-order compensation payloads handed to the saga engine; the EXISTING\nSagaRecoveryWorker dispatches these (reverse-order) when the workflow is\ncancelled. Matches `runtime::saga_compensators::CompensationPayload`."
        },
        "correlationId": {
          "type": "string"
        },
        "sagaId": {
          "type": "string",
          "description": "The saga row this workflow recorded in `udb_sagas` (the reused engine record).\nCancellation flips this saga into the recoverable state so the existing\nrecovery worker runs its compensations."
        },
        "pendingSignal": {
          "type": "string",
          "description": "When WAITING_SIGNAL, the signal name the workflow is blocked on."
        },
        "lastError": {
          "type": "string"
        },
        "nextRunAt": {
          "type": "string",
          "format": "date-time",
          "description": "When the workflow is next eligible to advance. NULL once terminal."
        },
        "lastTransitionAt": {
          "type": "string",
          "format": "date-time"
        },
        "auditInfo": {
          "$ref": "#/definitions/v1AuditInfo"
        },
        "deletedAt": {
          "type": "string",
          "format": "date-time"
        },
        "deletedBy": {
          "type": "string"
        }
      },
      "description": "WorkflowInstance — a durable, tenant-scoped multi-step operation orchestrated by\nthe native WorkflowService (master-plan 9.12). The instance is the durable state\nthat survives a broker restart or leader change: it carries the workflow_type\ndiscriminator, the current/total step counters, the opaque payload, the\nreverse-order compensation list, and a link to the saga row the EXISTING saga\nengine recorded for it. Forward progress is driven by the leader-elected workflow\ntick (`FOR UPDATE SKIP LOCKED`, one advancer cluster-wide); cancellation hands the\nlinked saga to the existing `SagaRecoveryWorker` so compensation reuses the\nestablished reverse-order machinery rather than reimplementing it."
    },
    "v1WorkflowStatus": {
      "type": "string",
      "enum": [
        "WORKFLOW_STATUS_UNSPECIFIED",
        "WORKFLOW_STATUS_PENDING",
        "WORKFLOW_STATUS_RUNNING",
        "WORKFLOW_STATUS_WAITING_SIGNAL",
        "WORKFLOW_STATUS_COMPLETED",
        "WORKFLOW_STATUS_COMPENSATING",
        "WORKFLOW_STATUS_COMPENSATED",
        "WORKFLOW_STATUS_CANCELLED",
        "WORKFLOW_STATUS_FAILED"
      ],
      "default": "WORKFLOW_STATUS_UNSPECIFIED",
      "description": "Lifecycle status of a durable workflow instance (master-plan 9.12). Only RUNNING\ninstances whose next_run_at is due are claimed by the leader-elected workflow\ntick; terminal states (COMPLETED / COMPENSATED / CANCELLED / FAILED) are never\nre-advanced. COMPENSATING is the transitional state while the EXISTING saga\nrecovery worker reverses the recorded compensations (reverse-order).\n\n - WORKFLOW_STATUS_PENDING: Recorded but not yet eligible to advance.\n - WORKFLOW_STATUS_RUNNING: Eligible to advance when next_run_at is due.\n - WORKFLOW_STATUS_WAITING_SIGNAL: Blocked on an external signal (SignalWorkflow resumes it).\n - WORKFLOW_STATUS_COMPLETED: All steps advanced; terminal success.\n - WORKFLOW_STATUS_COMPENSATING: Cancellation requested; the saga compensation path is undoing side effects.\n - WORKFLOW_STATUS_COMPENSATED: Compensation completed; terminal.\n - WORKFLOW_STATUS_CANCELLED: Cancelled by an operator; terminal.\n - WORKFLOW_STATUS_FAILED: Forward execution failed; terminal."
    }
  }
}