{"openapi":"3.0.0","paths":{"/v1/public/stats/synthetic-payments":{"get":{"operationId":"PublicStatsController_syntheticPayments","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}}],"responses":{"200":{"description":"","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}}},"tags":["Public stats"]}},"/v1/audit-events/cursor":{"get":{"description":"Call it before acting, then list (or wait) with `after_seq=<seq>` to see only what happened since. 0 before the first event.","operationId":"AuditEventsController_cursor","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"The tenant's high-water audit sequence number when this response was read.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditCursorDto"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Current high-water sequence number of the workspace's audit trail","tags":["Audit events"],"x-required-scopes":["audit.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/audit-events/actions":{"get":{"description":"Every action dispute.markets records, with its target type, what triggers it (an HTTP route, or `cron` / `job` / `delivery` / `guard`), and the exact `changes` fields and `metadata` keys (with types) it may emit. `async: true` actions are written after the response; wait for them. New actions and keys are additive.","operationId":"AuditEventsController_actions","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Cache-Control":{"description":"`private, max-age=3600`: the catalogue changes only with a release, so a client may keep it for an hour.","schema":{"type":"string"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditCatalogDto"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"The audit action catalogue","tags":["Audit events"],"x-required-scopes":["audit.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/audit-events":{"get":{"description":"Cursor-paginated, newest first by default (`order=desc`); use `order=asc` to replay a sequence. All filters are ANDed; `action` entries are ORed. `high_water_seq` is read in the same snapshot as `data`: continuing with `after_seq=high_water_seq` neither misses nor repeats an event. A cursor is valid only with the filters and order it was issued for (else 400 `invalid_cursor`). Without `audit.read_sensitive` (API keys never hold it) `request.ip`, `request.user_agent` and a user actor's `display` are null and authentication actions' metadata is stripped.","operationId":"AuditEventsController_list","parameters":[{"name":"before_seq","required":false,"in":"query","description":"Only events with `seq` less than this.","schema":{"format":"int64","type":"integer"}},{"name":"since","required":false,"in":"query","description":"Only events at or after this instant.","schema":{"format":"date-time","type":"string"}},{"name":"until","required":false,"in":"query","description":"Only events before this instant.","schema":{"format":"date-time","type":"string"}},{"name":"action","required":false,"in":"query","description":"Comma list of actions; an entry ending in `.*` matches the family (`dispute.*` matches `dispute.accept`, not `dispute_x.accept`). Up to 20 entries.","schema":{"example":"dispute.accept,webhook_delivery.*","type":"string"}},{"name":"outcome","required":false,"in":"query","schema":{"type":"string","enum":["success","denied","failed"]}},{"name":"actor_type","required":false,"in":"query","schema":{"type":"string","enum":["user","synthetic_account","api_key","system"]}},{"name":"actor_id","required":false,"in":"query","description":"Exact actor id (`sa_…`, key id, end-user id).","schema":{"type":"string"}},{"name":"target_type","required":false,"in":"query","description":"Exact target type, e.g. `dispute`.","schema":{"type":"string"}},{"name":"target_id","required":false,"in":"query","description":"Exact target display id, e.g. `dsp_…`.","schema":{"type":"string"}},{"name":"correlation_id","required":false,"in":"query","description":"Exact correlation id, or a prefix: at least 4 characters followed by one trailing `*` (`run_8f2:*`). `_` and `%` are literal. `*` alone or a shorter prefix is rejected.","schema":{"maxLength":128,"pattern":"^(?:[A-Za-z0-9._:/-]{1,128}|[A-Za-z0-9._:/-]{4,127}\\*)$","example":"run_8f2:*","type":"string"}},{"name":"request_id","required":false,"in":"query","description":"Exact request id (`req_…`).","schema":{"type":"string"}},{"name":"source","required":false,"in":"query","schema":{"type":"string","enum":["portal","api","system"]}},{"name":"parent_id","required":false,"in":"query","description":"Children of this event (`aud_…`).","schema":{"pattern":"^aud_[0-9A-Z]{24}$","type":"string"}},{"name":"flow_profile_id","required":false,"in":"query","description":"Events whose action a flow profile changed: `fp_…@N` matches that version only, `fp_…` any version of the profile.","schema":{"maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2","type":"string"}},{"name":"after_seq","required":false,"in":"query","description":"Only events with `seq` greater than this.","schema":{"format":"int64","type":"integer"}},{"name":"order","required":false,"in":"query","description":"Sort by `seq`. Default `desc` (newest first); tests that replay a sequence use `asc`.","schema":{"default":"desc","type":"string","enum":["asc","desc"]}},{"name":"limit","required":false,"in":"query","schema":{"minimum":1,"maximum":200,"default":50,"type":"integer"}},{"name":"cursor","required":false,"in":"query","description":"Opaque `pagination.next_cursor` of the previous page.","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"The tenant's high-water audit sequence number when this response was read.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditEventListDto"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"List the workspace's audit events","tags":["Audit events"],"x-required-scopes":["audit.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/audit-events/wait":{"get":{"description":"Answers as soon as at least `min_count` events matching the filters exist after `after_seq`, or after `timeout_s` seconds, so a test never needs to sleep. Always 200: `satisfied: true` with the matches, or `satisfied: false` with the matches seen so far. `data` is oldest first. Continue with `after_seq=high_water_seq` to wait for later events without gaps or repeats. Needs `after_seq` and at least one narrowing filter: `correlation_id`, `request_id`, `target_id`, or `action` as exact names or prefixes of at least two segments (else 400 `wait_filter_too_broad`). At most 12 concurrent waits per caller and 12 per workspace per server (429 `too_many_waits` with `Retry-After: 1`). A server's wait slots are shared fairly between workspaces: when they are all taken, a workspace holding fewer than the busiest one still gets a slot, and the busiest workspace's oldest wait answers early with `satisfied: false`, exactly like a timeout (continue with `after_seq=high_water_seq`). Events committed by another server are seen within about a second. Same projection as the list.","operationId":"AuditEventsController_wait","parameters":[{"name":"before_seq","required":false,"in":"query","description":"Only events with `seq` less than this.","schema":{"format":"int64","type":"integer"}},{"name":"since","required":false,"in":"query","description":"Only events at or after this instant.","schema":{"format":"date-time","type":"string"}},{"name":"until","required":false,"in":"query","description":"Only events before this instant.","schema":{"format":"date-time","type":"string"}},{"name":"action","required":false,"in":"query","description":"Comma list of actions; an entry ending in `.*` matches the family (`dispute.*` matches `dispute.accept`, not `dispute_x.accept`). Up to 20 entries.","schema":{"example":"dispute.accept,webhook_delivery.*","type":"string"}},{"name":"outcome","required":false,"in":"query","schema":{"type":"string","enum":["success","denied","failed"]}},{"name":"actor_type","required":false,"in":"query","schema":{"type":"string","enum":["user","synthetic_account","api_key","system"]}},{"name":"actor_id","required":false,"in":"query","description":"Exact actor id (`sa_…`, key id, end-user id).","schema":{"type":"string"}},{"name":"target_type","required":false,"in":"query","description":"Exact target type, e.g. `dispute`.","schema":{"type":"string"}},{"name":"target_id","required":false,"in":"query","description":"Exact target display id, e.g. `dsp_…`.","schema":{"type":"string"}},{"name":"correlation_id","required":false,"in":"query","description":"Exact correlation id, or a prefix: at least 4 characters followed by one trailing `*` (`run_8f2:*`). `_` and `%` are literal. `*` alone or a shorter prefix is rejected.","schema":{"maxLength":128,"pattern":"^(?:[A-Za-z0-9._:/-]{1,128}|[A-Za-z0-9._:/-]{4,127}\\*)$","example":"run_8f2:*","type":"string"}},{"name":"request_id","required":false,"in":"query","description":"Exact request id (`req_…`).","schema":{"type":"string"}},{"name":"source","required":false,"in":"query","schema":{"type":"string","enum":["portal","api","system"]}},{"name":"parent_id","required":false,"in":"query","description":"Children of this event (`aud_…`).","schema":{"pattern":"^aud_[0-9A-Z]{24}$","type":"string"}},{"name":"flow_profile_id","required":false,"in":"query","description":"Events whose action a flow profile changed: `fp_…@N` matches that version only, `fp_…` any version of the profile.","schema":{"maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2","type":"string"}},{"name":"after_seq","required":true,"in":"query","description":"Required. Only events with `seq` greater than this: the `seq` from `GET /v1/audit-events/cursor` taken before acting, or the previous wait's `high_water_seq`.","schema":{"format":"int64","example":1042,"type":"integer"}},{"name":"min_count","required":false,"in":"query","description":"Return as soon as at least this many matching events exist.","schema":{"minimum":1,"maximum":50,"default":1,"type":"integer"}},{"name":"timeout_s","required":false,"in":"query","description":"Give up after this many seconds and answer `satisfied: false` with what matched so far.","schema":{"minimum":1,"maximum":25,"default":10,"type":"integer"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"The tenant's high-water audit sequence number when this response was read.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditWaitResultDto"}}}},"400":{"description":"`wait_filter_too_broad`: no narrowing filter; `validation_failed`: a malformed or missing parameter. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"string","example":"1"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Wait until matching audit events exist (bounded long-poll)","tags":["Audit events"],"x-required-scopes":["audit.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/audit-events/export":{"get":{"description":"The same filters as the list, oldest first, streamed. The window is `since`..`until` (default: the last 31 days; at most 31 days, else 400 `export_range_too_large`). At most 100,000 rows (10,000 for API keys), checked before the first byte (413 `export_too_large`). The file holds exactly the matching events committed when the export started. One export per workspace at a time (429 `export_in_progress`). Each export is itself audited (`audit_event.export`, with the filters and row count). CSV: one header row; `changes` and `metadata` as JSON cells; a cell starting with `=`, `+`, `-`, `@`, tab or CR is prefixed with `'` so spreadsheets do not evaluate it. Same redacted projection as the list for callers without `audit.read_sensitive`.","operationId":"AuditEventsController_export","parameters":[{"name":"before_seq","required":false,"in":"query","description":"Only events with `seq` less than this.","schema":{"format":"int64","type":"integer"}},{"name":"since","required":false,"in":"query","description":"Only events at or after this instant.","schema":{"format":"date-time","type":"string"}},{"name":"until","required":false,"in":"query","description":"Only events before this instant.","schema":{"format":"date-time","type":"string"}},{"name":"action","required":false,"in":"query","description":"Comma list of actions; an entry ending in `.*` matches the family (`dispute.*` matches `dispute.accept`, not `dispute_x.accept`). Up to 20 entries.","schema":{"example":"dispute.accept,webhook_delivery.*","type":"string"}},{"name":"outcome","required":false,"in":"query","schema":{"type":"string","enum":["success","denied","failed"]}},{"name":"actor_type","required":false,"in":"query","schema":{"type":"string","enum":["user","synthetic_account","api_key","system"]}},{"name":"actor_id","required":false,"in":"query","description":"Exact actor id (`sa_…`, key id, end-user id).","schema":{"type":"string"}},{"name":"target_type","required":false,"in":"query","description":"Exact target type, e.g. `dispute`.","schema":{"type":"string"}},{"name":"target_id","required":false,"in":"query","description":"Exact target display id, e.g. `dsp_…`.","schema":{"type":"string"}},{"name":"correlation_id","required":false,"in":"query","description":"Exact correlation id, or a prefix: at least 4 characters followed by one trailing `*` (`run_8f2:*`). `_` and `%` are literal. `*` alone or a shorter prefix is rejected.","schema":{"maxLength":128,"pattern":"^(?:[A-Za-z0-9._:/-]{1,128}|[A-Za-z0-9._:/-]{4,127}\\*)$","example":"run_8f2:*","type":"string"}},{"name":"request_id","required":false,"in":"query","description":"Exact request id (`req_…`).","schema":{"type":"string"}},{"name":"source","required":false,"in":"query","schema":{"type":"string","enum":["portal","api","system"]}},{"name":"parent_id","required":false,"in":"query","description":"Children of this event (`aud_…`).","schema":{"pattern":"^aud_[0-9A-Z]{24}$","type":"string"}},{"name":"flow_profile_id","required":false,"in":"query","description":"Events whose action a flow profile changed: `fp_…@N` matches that version only, `fp_…` any version of the profile.","schema":{"maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2","type":"string"}},{"name":"format","required":false,"in":"query","description":"`csv` (one header row, objects as JSON cells) or `ndjson` (one event JSON per line).","schema":{"default":"ndjson","type":"string","enum":["csv","ndjson"]}},{"name":"after_seq","required":false,"in":"query","description":"Only events with `seq` greater than this.","schema":{"format":"int64","type":"integer"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"The export file (`Content-Disposition: attachment`).","content":{"text/csv; charset=utf-8":{"schema":{"type":"string","example":"id,seq,occurred_at,action,...\r\n"}},"application/x-ndjson; charset=utf-8":{"schema":{"type":"string","description":"One `AuditEvent` JSON per line."}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Sequence number of the `audit_event.export` row this export wrote.","schema":{"type":"string","pattern":"^[0-9]+$"}},"X-Export-Row-Count":{"description":"Rows in the file.","schema":{"type":"string","pattern":"^[0-9]+$"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`export_range_too_large`: the window is wider than 31 days; `validation_failed`: a malformed parameter. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"text/csv; charset=utf-8":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}},"application/x-ndjson; charset=utf-8":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"413":{"description":"`export_too_large`: more rows match than the cap; narrow the window or the filters.","content":{"text/csv; charset=utf-8":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}},"application/x-ndjson; charset=utf-8":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"string","example":"5"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"content":{"text/csv; charset=utf-8":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}},"application/x-ndjson; charset=utf-8":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"text/csv; charset=utf-8":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}},"application/x-ndjson; charset=utf-8":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Export audit events as CSV or NDJSON","tags":["Audit events"],"x-required-scopes":["audit.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/audit-events/{id}":{"get":{"description":"By its `aud_…` id. An id that is not this workspace's is 404, never 403.","operationId":"AuditEventsController_get","parameters":[{"name":"id","required":true,"in":"path","description":"Event id (`aud_…`).","schema":{"type":"string","pattern":"^aud_[0-9A-Z]{24}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"The tenant's high-water audit sequence number when this response was read.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditEventDto"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no such event in this workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get one audit event","tags":["Audit events"],"x-required-scopes":["audit.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/scheduled-jobs":{"get":{"description":"Pending and recent background work of the workspace (generate chunks, delayed flow steps), newest first. Filter by `state`, `kind`, `target_id`, `generate_job_id` or `correlation_id`. Finished jobs are kept 7 days (failed: 30).","operationId":"ScheduledJobsController_list","parameters":[{"name":"state","required":false,"in":"query","schema":{"type":"string","enum":["scheduled","running","succeeded","failed","canceled"]}},{"name":"kind","required":false,"in":"query","schema":{"type":"string","enum":["generate.run","generate.trickle_batch","generate.cleanup","dev.reset","report.build","report.purge","evidence.process","dispute.complete_action","dispute.deadline","dispute.rule","dispute.escalate","webhook_delivery.release","flow_profile.release_accounts","synthetic_account.setup_delivery_check","workspace_invite.delivery_check","workspace.purge","system.noop"]}},{"name":"target_id","required":false,"in":"query","description":"Display id of the target resource.","schema":{"example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2","type":"string"}},{"name":"generate_job_id","required":false,"in":"query","description":"Jobs of one generate job (`gj_…`).","schema":{"example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2","type":"string"}},{"name":"correlation_id","required":false,"in":"query","description":"X-Correlation-Id, exact or a prefix of at least 4 characters with a trailing `*`.","schema":{"example":"run_8f2:*","type":"string"}},{"name":"limit","required":false,"in":"query","schema":{"minimum":1,"maximum":200,"default":50,"type":"integer"}},{"name":"cursor","required":false,"in":"query","description":"Opaque `pagination.next_cursor` of the previous page.","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScheduledJobListDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed` or `invalid_cursor`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"List scheduled jobs","tags":["Scheduled jobs"],"x-required-scopes":["flow.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/scheduled-jobs/fast-forward":{"post":{"description":"Moves the selected `scheduled` jobs earlier so a test never has to wait: to now (default), `by` a duration (bounded by each job's remaining delay) or `to_remaining` a duration. The target's own timeline (a report's ready time, a deadline) moves by the same amount. Moved jobs get priority over the workspace's other due work. Exactly one selector: `job_ids`, `target_id`, `generate_job_id` or `correlation_id` (else 400 `validation_failed`), optionally narrowed by `kind` and `state`. At most 500 jobs may match (else 400 `too_many_matches`). Ids of another workspace match nothing. Jobs already running or finished are listed with their state. With `wait: true` the call returns once every moved job is terminal and so is every job those scheduled for the same target meanwhile (a report's build phase), or after 25 s; `terminal` is true only then. A fast-forward to now of an async report also skips its simulated build (`report.delivery.build_s`), so the report is done when the call returns. Recorded as `scheduled_job.fast_forward`.","operationId":"ScheduledJobsController_fastForward","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FastForwardDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScheduledJobBulkResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed` (no selector or several, `by` with `to_remaining`, a malformed duration) or `too_many_matches`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"string","example":"1"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Fast-forward scheduled jobs (time travel)","tags":["Scheduled jobs"],"x-idempotent":"replay","x-required-scopes":["flow.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/scheduled-jobs/cancel":{"post":{"description":"Cancels the selected jobs that are still `scheduled` or `running`; each kind puts its target in the matching state (a generate job becomes `canceled`, keeping its committed rows). Exactly one selector: `job_ids`, `target_id`, `generate_job_id` or `correlation_id` (else 400 `validation_failed`), optionally narrowed by `kind` and `state`. At most 500 jobs may match (else 400 `too_many_matches`). Ids of another workspace match nothing. Finished jobs are listed with their state. Recorded as `scheduled_job.cancel`.","operationId":"ScheduledJobsController_cancelMany","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelScheduledJobsDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScheduledJobBulkResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed` (no selector or several) or `too_many_matches`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Cancel scheduled jobs","tags":["Scheduled jobs"],"x-idempotent":"replay","x-required-scopes":["flow.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/scheduled-jobs/{id}/cancel":{"post":{"description":"Cancels the job if it is still `scheduled` or `running` (`count: 1`); a finished job is returned with its state and `count: 0`. Recorded as `scheduled_job.cancel`.","operationId":"ScheduledJobsController_cancelOne","parameters":[{"name":"id","required":true,"in":"path","description":"The scheduled job id (`sj_…`).","schema":{"example":"sj_01J9Z3K4M5N6P7Q8R9S0T1V2","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScheduledJobBulkResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"No such job in the caller's workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Cancel one scheduled job","tags":["Scheduled jobs"],"x-idempotent":"replay","x-required-scopes":["flow.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/scheduled-jobs/{id}":{"get":{"description":"With `wait_s` (at most 25), returns once the job is terminal or the time is up, whichever comes first; check `state`. No `audit.read` needed.","operationId":"ScheduledJobsController_get","parameters":[{"name":"id","required":true,"in":"path","description":"The scheduled job id (`sj_…`).","schema":{"example":"sj_01J9Z3K4M5N6P7Q8R9S0T1V2","type":"string"}},{"name":"wait_s","required":false,"in":"query","description":"Wait up to this many seconds for the job to reach a terminal state (`succeeded`, `failed`, `canceled`); the job is returned as it is then. At most 8 waits per caller at a time per server.","schema":{"minimum":0,"maximum":25,"type":"integer"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScheduledJobDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"No such job in the caller's workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"string","example":"1"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a scheduled job","tags":["Scheduled jobs"],"x-required-scopes":["flow.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/me/background-tasks":{"get":{"description":"Long-running work you started and follow (generate jobs, watches over scheduled jobs): every active task and every task that finished in the last 24 hours, unless dismissed, active first. Tasks of a kind you no longer have the permission for are left out. Poll after `poll_after_ms` (2000 ms while something is active, else 30000 ms) with `If-None-Match` set to the last `ETag`: an unchanged feed answers 304 with no body after a single index read. Signed-in users only; API keys get 403 `session_required`.","operationId":"BackgroundTasksController_feed","parameters":[{"name":"limit","required":false,"in":"query","schema":{"minimum":1,"maximum":50,"default":20,"type":"integer"}},{"name":"If-None-Match","in":"header","description":"The `ETag` of the last feed you read (`\"bt-<rev>-<count>\"`); 304 when nothing changed.","required":false,"schema":{"type":"string","example":"\"bt-1042-2\""}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"ETag":{"description":"Strong validator of this feed: `\"bt-<rev>-<count>\"`.","schema":{"type":"string","example":"\"bt-1042-2\""}},"Cache-Control":{"description":"`private, no-cache`: revalidate every time.","schema":{"type":"string"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BackgroundTaskFeedDto"}}}},"304":{"description":"Not modified: `If-None-Match` matches the current `ETag`. No body.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"ETag":{"description":"The current (unchanged) validator.","schema":{"type":"string","example":"\"bt-1042-2\""}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed` (`limit` outside 1-50). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`session_required`: called with an API key (the feed belongs to a signed-in person). `missing_permission` on watch without `flow.write`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"My background tasks","tags":["Background tasks"]}},"/v1/me/background-tasks/dismiss-finished":{"post":{"description":"Hides every finished task from your feed (active ones stay). Not audited: tray state, like preferences.","operationId":"BackgroundTasksController_dismissFinished","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DismissFinishedDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`session_required`: called with an API key (the feed belongs to a signed-in person). `missing_permission` on watch without `flow.write`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Dismiss all my finished tasks","tags":["Background tasks"]}},"/v1/me/background-tasks/watch":{"post":{"description":"Creates a `scheduled_jobs.watch` task over the scheduled jobs the selector matches now (at most 500). Its progress is how many of them have finished (`unit: jobs`); it succeeds once all have, with their counts in `result.counts`. At most 10 active watches per person. Needs `flow.write`.","operationId":"BackgroundTasksController_watch","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WatchScheduledJobsDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BackgroundTaskDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed` (no selector or several), `too_many_matches` (over 500) or `no_matching_jobs`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`session_required`: called with an API key (the feed belongs to a signed-in person). `missing_permission` on watch without `flow.write`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`too_many_watches`: you already follow 10 active watches. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Follow scheduled jobs in my tray","tags":["Background tasks"],"x-required-scopes":["flow.write"]}},"/v1/me/background-tasks/{id}/dismiss":{"post":{"description":"Hides a finished task from your feed. 409 `task_active` while it is still queued or running. Another person's task, or another workspace's, is 404. Dismissing twice is a no-op. Not audited.","operationId":"BackgroundTasksController_dismiss","parameters":[{"name":"id","required":true,"in":"path","description":"The task id (`bt_…`).","schema":{"example":"bt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DismissedTaskDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`: not a `bt_…` id. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`session_required`: called with an API key (the feed belongs to a signed-in person). `missing_permission` on watch without `flow.write`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"No such task of yours in this workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`task_active`: the task has not finished yet. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Dismiss one finished task","tags":["Background tasks"]}},"/v1/flows/catalogue":{"get":{"description":"Every variant key a flow profile may set: the operation it changes, its JSON Schema (bounds), the platform default, its scope (`request` or `stamped`) and what it can emit (error codes, audit actions, webhook events). The same list is published on the docs site.","operationId":"FlowsController_catalogue","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FlowCatalogueDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Flow variant catalogue","tags":["Flows"],"x-required-scopes":["flow.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/flows/limits":{"get":{"description":"Every cap of the flow system (profiles, versions, pending scheduled work, value bounds) with the workspace's current usage and the usage of the caller's correlation prefix (send `X-Correlation-Id: <prefix>:…`).","operationId":"FlowsController_limits","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FlowLimitsDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Flow limits and usage","tags":["Flows"],"x-required-scopes":["flow.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/flow-profiles":{"get":{"description":"Live profiles of the workspace, newest first (`include_archived=true` adds archived ones), each with `used_by`.","operationId":"FlowProfilesController_list","parameters":[{"name":"include_archived","required":false,"in":"query","description":"Also list archived profiles.","schema":{"default":false,"type":"boolean"}},{"name":"limit","required":false,"in":"query","schema":{"minimum":1,"maximum":100,"default":50,"type":"integer"}},{"name":"cursor","required":false,"in":"query","description":"Opaque cursor from the previous page's `pagination.next_cursor`.","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FlowProfileListDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed` or `invalid_cursor`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"List flow profiles","tags":["Flow profiles"],"x-required-scopes":["flow.read"],"x-api-key":true,"x-key-grantable":true},"post":{"description":"Creates version 1. Idempotent by name and body: if a live profile already has this `name` and the same body (`description` and `variants`), it is returned with 200 and nothing is written; a different body is 409 `flow_profile_name_taken`. A name is free again once its holder is archived. Recorded as `flow_profile.create`.","operationId":"FlowProfilesController_create","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateFlowProfileDto"}}}},"responses":{"200":{"description":"A live profile with this name and body already existed; it is returned unchanged.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FlowProfileDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"201":{"description":"Created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FlowProfileDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed` (name or description) or `invalid_flow_variant` (an unknown key or a value out of its schema; `details: [{field, constraints}]`). Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`flow_profile_name_taken` (same name, different body; `details.profile_id`) or `flow_profile_limit` (100 live profiles, or variants over 16 KB). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Create a flow profile","tags":["Flow profiles"],"x-idempotent":"replay","x-required-scopes":["flow.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/flow-profiles/default":{"put":{"description":"What requests without `X-DM-Flow` (and synthetic accounts without an assigned profile) resolve to. `fp_…` pins the current version, `fp_…@N` pins N; `null` or `fp_platform` clears it. Only the owner's signed-in session can call it: `flow.default.write` is never granted to an API key (a key gets 403 `missing_scope` and a denied audit event). Resources created earlier keep their stamps. Recorded as `tenant_flow_default.update`.","operationId":"FlowProfilesController_setDefault","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFlowDefaultDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FlowDefaultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed` or `invalid_flow_profile` (not a live profile of this workspace, or no such version). Also `idempotency_key_invalid` (malformed Idempotency-Key).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Set the workspace default flow profile","tags":["Flow profiles"],"x-idempotent":"replay","x-required-scopes":["flow.default.write"],"x-api-key":true,"x-key-grantable":false}},"/v1/flow-profiles/{id}":{"get":{"description":"The profile with its current version's body and `used_by`.","operationId":"FlowProfilesController_get","parameters":[{"name":"id","required":true,"in":"path","description":"The flow profile id (`fp_…`).","schema":{"example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FlowProfileDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"No such profile in the caller's workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a flow profile","tags":["Flow profiles"],"x-required-scopes":["flow.read"],"x-api-key":true,"x-key-grantable":true},"patch":{"description":"Writes a new immutable version with the given `variants` and/or `description` and moves `current_version`. Pinned references (`fp_…@N`) keep resolving to their version. The same body as the current version changes nothing. Recorded as `flow_profile.update` (`changes.variants` is the per-key diff).","operationId":"FlowProfilesController_update","parameters":[{"name":"id","required":true,"in":"path","description":"The flow profile id (`fp_…`).","schema":{"example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateFlowProfileDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FlowProfileDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed` (neither field sent) or `invalid_flow_variant`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"No such profile in the caller's workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`flow_profile_archived` or `flow_profile_limit` (50 versions, or variants over 16 KB). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Change a flow profile (new version)","tags":["Flow profiles"],"x-idempotent":"replay","x-required-scopes":["flow.write"],"x-api-key":true,"x-key-grantable":true},"delete":{"description":"Soft delete; there is no hard delete. The name is free again at once. Requests naming it in `X-DM-Flow` keep working for 24 hours (with `X-DM-Flow-Warning: archived`), then get 400 `invalid_flow_profile`. Allowed while synthetic accounts use it (`used_by.synthetic_accounts`): they keep it for 24 hours with the same warning, then fall back to the workspace default, and a `flow_profile.release_accounts` scheduled job clears their assignments. Idempotent. Recorded as `flow_profile.delete`.","operationId":"FlowProfilesController_archive","parameters":[{"name":"id","required":true,"in":"path","description":"The flow profile id (`fp_…`).","schema":{"example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FlowProfileDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"No such profile in the caller's workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Archive a flow profile","tags":["Flow profiles"],"x-idempotent":"replay","x-required-scopes":["flow.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/flow-profiles/{id}/versions":{"get":{"description":"Every kept version, newest first (at most 50).","operationId":"FlowProfilesController_versions","parameters":[{"name":"id","required":true,"in":"path","description":"The flow profile id (`fp_…`).","schema":{"example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FlowProfileVersionListDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"No such profile in the caller's workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"List a flow profile's versions","tags":["Flow profiles"],"x-required-scopes":["flow.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/api-keys":{"get":{"description":"The tenant's keys, newest first, cursor-paginated. Never includes a secret. `creator_status: removed` marks a key whose creator (or last rotator) is no longer a member of this workspace: the key is refused (401 `invalid_api_key`) and what it set up is disabled. Rotate it to vouch for it again, or revoke it.","operationId":"ApiKeysController_list","parameters":[{"name":"status","required":false,"in":"query","schema":{"type":"string","enum":["active","expired","revoked"]}},{"name":"limit","required":false,"in":"query","schema":{"minimum":1,"maximum":100,"default":50,"type":"number"}},{"name":"cursor","required":false,"in":"query","description":"The `next_cursor` of the previous page.","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyPageDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the authentication service did not answer; see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"List API keys","tags":["API keys"],"x-required-scopes":["api_key.manage"]},"post":{"description":"Mints a key and returns its secret ONCE. The key acts for this tenant with the given scopes, never above your own role, until it expires (7, 30, 90 or 365 days) or is revoked. Replaying the same `Idempotency-Key` never shows the secret again: 409 `idempotency_secret_not_replayable` with `details.resource_id`. Audited as `api_key.create` (the secret is never recorded).","operationId":"ApiKeysController_create","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional; makes a retry safe for 24 hours (1-255 characters of `A-Z a-z 0-9 _ . : -`; otherwise 400 `invalid_idempotency_key`). A retry never shows the secret again: it is 409 `idempotency_secret_not_replayable` with `details.resource_id` (the key it created). The same value with a different body is 409 `idempotency_key_reuse`.","required":false,"schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateApiKeyDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyWithSecretDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`, `invalid_idempotency_key`, `tenant_api_key_scope_not_grantable` (a scope this app does not offer) or `tenant_api_key_expiry_invalid`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (owners only), `step_up_required` (the session last proved a second factor more than 15 minutes ago: call `POST /v1/auth/mfa/step-up`, then retry) or `tenant_api_key_scope_above_ceiling` (`scopes` your own role does not hold).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`tenant_api_key_limit` (25 active keys per workspace: revoke one first), `idempotency_secret_not_replayable` (`details.resource_id`) or `idempotency_key_reuse`. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`; see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Create an API key","tags":["API keys"],"x-required-scopes":["api_key.manage"]}},"/v1/api-keys/options":{"get":{"description":"The scopes a key may carry (with one-line descriptions), the \"E2E testing\" preset (all of them), the allowed expiries and the longest rotation grace. The portal builds its create and rotate forms from this, so it never keeps a second list.","operationId":"ApiKeysController_options","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyOptionsDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"API key form options","tags":["API keys"],"x-required-scopes":["api_key.manage"]}},"/v1/api-keys/{id}/rotate":{"post":{"description":"Issues a new key with the same name and scopes (re-checked against your role) and returns its secret once. The old key keeps working for `grace_hours` (default 0: it stops now). Do not rotate a leaked key: revoke it. Audited as `api_key.rotate`.","operationId":"ApiKeysController_rotate","parameters":[{"name":"id","required":true,"in":"path","description":"Key id (`tak_…`).","schema":{"example":"tak_3a9f2b1c0d4e","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional; makes a retry safe for 24 hours (1-255 characters of `A-Z a-z 0-9 _ . : -`; otherwise 400 `invalid_idempotency_key`). A retry never shows the secret again: it is 409 `idempotency_secret_not_replayable` with `details.resource_id` (the key it created). The same value with a different body is 409 `idempotency_key_reuse`.","required":false,"schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RotateApiKeyDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyWithSecretDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed` (`grace_hours` outside 0-24), `invalid_idempotency_key` or `tenant_api_key_expiry_invalid`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (owners only), `step_up_required` (the session last proved a second factor more than 15 minutes ago: call `POST /v1/auth/mfa/step-up`, then retry) or `tenant_api_key_scope_above_ceiling` (`scopes` your own role does not hold).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found` (not a `tak_…` id) or `tenant_api_key_not_found` (no such key in this workspace).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`tenant_api_key_not_active` (revoked or expired keys cannot be rotated), `tenant_api_key_scope_not_grantable` (a scope of the key is no longer offered), `idempotency_secret_not_replayable` or `idempotency_key_reuse`. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`; see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Rotate an API key","tags":["API keys"],"x-required-scopes":["api_key.manage"]}},"/v1/api-keys/{id}":{"delete":{"description":"The key stops working at once on the replica that served this call and within 30 seconds everywhere. Webhooks and playbooks it created are disabled. Audited as `api_key.revoke` with `metadata.already_revoked` (true on a repeat, which changes nothing), and `api_key.deactivate` once, carrying this request's request id and correlation id.","operationId":"ApiKeysController_revoke","parameters":[{"name":"id","required":true,"in":"path","description":"Key id (`tak_…`).","schema":{"example":"tak_3a9f2b1c0d4e","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"204":{"description":"Revoked (also when it already was).","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Not signed in, or called with an API key (`api_key_not_allowed`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found` (not a `tak_…` id) or `tenant_api_key_not_found` (no such key in this workspace).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`; see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Revoke an API key","tags":["API keys"],"x-required-scopes":["api_key.manage"]}},"/v1/whoami":{"get":{"description":"The tenant, the actor (as audit events record it), the effective permissions and, for an API key, the key. Needs no permission. Callers holding `flow.read` also get `flow`: the workspace default and the profile this request resolved to (send `X-DM-Flow` to check one).","operationId":"WhoamiController_whoami","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WhoamiDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Who am I","tags":["Identity"],"x-api-key":true,"x-key-grantable":true}},"/v1/team/synthetic-accounts":{"get":{"operationId":"TeamController_list","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyntheticAccountListDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"List synthetic (bot) accounts in this tenant","tags":["Team — synthetic accounts"],"x-required-scopes":["team.read"]},"post":{"description":"Creates the sign-in account, adds it as a tenant member, verifies the email, sets the password, and (when `mfa_enabled: true`) provisions an MFA factor + recovery codes — TOTP by default, or email codes via `mfa_method: \"email\"` (requires a base email). Optionally assigns a `flow_profile` (owner only, `flow.write`). The full credential bundle is returned once — store it now.\n\nWith `credential_mode: \"email\"` (needs `email`) the password is never shown: a single-use setup link, valid 72 hours, is mailed from notifications@dispute.markets to the account's address, and whoever opens it sets the password (and the two-factor factor). The response has `credentials: null` and `setup` (`status: pending`). If the mail cannot be sent, the account still exists with `setup.status: send_failed`; send it again with `email-setup`. Refusals before anything is created: 409 `setup_email_suppressed`, 429 `setup_email_rate_limited`, 409 `setup_pending_limit`, 503 `setup_email_unavailable` (each also recorded as a failed `synthetic_account.send_setup_email`). Recorded as `synthetic_account.create` (`metadata.credential_mode`) and, in email mode, `synthetic_account.send_setup_email`.","operationId":"TeamController_create","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSyntheticAccountDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyntheticAccountCreatedDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`, or `invalid_flow_profile`: `flow_profile` is not `fp_platform`, `fp_…` or `fp_…@N` (at most 72 characters), or not a live profile of this workspace with that version (an archived profile cannot be assigned). Address errors: `email_invalid` (quoted or non-ASCII local part, a dispute.markets domain, a malformed `email_tag`), `email_too_long` (no room for the tag in 64 characters), `email_not_verified` (not a verified email of yours), `email_required` (`credential_mode: \"email\"` without `email`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission`: the caller lacks a permission the route needs, or sent `flow_profile` (any value, `null` included) without `flow.write`; nothing is written and an `outcome=denied` audit event names the permission.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"Email mode, or a taken address: `email_taken` (the address is in use; pick a new `email_tag`), `setup_email_suppressed` (mail to this address bounced before; pick another email), `setup_pending_limit` (25 unused setup links in this workspace; archive or finish some first). Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`setup_email_rate_limited`: too many setup emails (per account: one per 60 s, 5 per 24 h; per workspace: 20 per hour, 60 per 24 h). `details.retry_after_s` and `Retry-After` say when to retry. `rate_limited`: the authentication service's limit on verification and password-reset codes from your IP (5 a minute) ran out; each create or address change uses 2, a resend that signs the account out, a switch from a generated password or a password rotation 1. Nothing was sent; retry after `Retry-After` seconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`setup_email_unavailable`: setup emails are unavailable right now (not configured, or the service-wide daily cap is reached). Use a generated password or retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Provision a fresh synthetic account","tags":["Team — synthetic accounts"],"x-required-scopes":["team.write"]}},"/v1/team/synthetic-accounts/{display_id}/email-setup":{"post":{"description":"Owner only (API keys cannot call it). Mails a single-use link, valid 72 hours, to the account's address; whoever opens it sets the password (and the factor in `mfa_method`). Any earlier unused link stops working.\n\n- **Generated account:** switches it to `credential_mode: \"email\"`. Its password is replaced by one nobody knows, every session ends and every two-factor factor is turned off at once; it cannot sign in until the link is used.\n- **Email account, link unused:** a resend. Nothing else changes.\n- **Email account, link used:** a restart. Like the switch, it signs the account out and turns off its password and factors first.\n- **`email` with another base, or a new `email_tag`:** changes the sign-in address (re-verified), then resends or restarts as above.\n\nEvery send checks that the inbox the mail lands in is still one of your verified emails: a resend or restart to an email you have since removed or unverified answers 400 `email_not_verified`; send `email` with a verified one instead.\n\nLimits: one send per account per 60 s, 5 per account and 60 per workspace per 24 hours, 20 per workspace per hour, 25 unused links per workspace. A send Envoi refuses still answers 200 with `setup.status: send_failed`. Retrying within the cooldown answers 429, so a retry never sends twice. Recorded as `synthetic_account.send_setup_email`.","operationId":"TeamController_emailSetup","parameters":[{"name":"display_id","required":true,"in":"path","description":"The synthetic account (`sa_…`).","schema":{"example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":false,"description":"Optional: a plain resend sends no body (or `{}`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailSetupDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyntheticAccountEnvelopeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`; `email_required`: the account has no mailbox and no `email` was sent. `email_invalid` (quoted or non-ASCII local part, a dispute.markets domain, a malformed `email_tag`), `email_too_long` (no room for the tag in 64 characters), `email_not_verified` (not a verified email of yours), `email_required` (`credential_mode: \"email\"` without `email`). `bad_request`: the authentication service refused the address change or the password reset (`message` says why); no link was sent. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission`: only the workspace owner may send setup links.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no synthetic account with this id in the workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`synthetic_account_archived`; `mail_owner_departed`: the account's mail goes to someone who is no longer an owner of this workspace (move its mail to you, or send `email`); `email_taken` (the address is in use; pick a new `email_tag`), `setup_email_suppressed` (mail to this address bounced before; pick another email), `setup_pending_limit` (25 unused setup links in this workspace; archive or finish some first). `credential_change_in_progress`: another change to this account's credentials (a setup link being used, a resend or restart, a rotation) is still running. Retry after `Retry-After` seconds. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`setup_email_rate_limited`: too many setup emails (per account: one per 60 s, 5 per 24 h; per workspace: 20 per hour, 60 per 24 h). `details.retry_after_s` and `Retry-After` say when to retry. `rate_limited`: the authentication service's limit on verification and password-reset codes from your IP (5 a minute) ran out; each create or address change uses 2, a resend that signs the account out, a switch from a generated password or a password rotation 1. Nothing was sent; retry after `Retry-After` seconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"502":{"description":"`auth_misconfigured`: the authentication service refused a request dispute.markets made for this account (changing its address, or revoking its old password and factors). No link was sent; retry, and quote `request_id` if it persists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`setup_email_unavailable`: setup emails are unavailable right now (not configured, or the service-wide daily cap is reached). Use a generated password or retry later. `auth_unavailable`: the authentication service is unavailable or did not answer. No link was sent; retry after `Retry-After` seconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Email a setup link: switch to email mode, resend, or change the address","tags":["Team — synthetic accounts"],"x-required-scopes":["team.write"]}},"/v1/team/synthetic-accounts/{display_id}":{"patch":{"description":"`flow_profile` (owner only, `flow.write`): omit to keep the assignment, `null` for the workspace default. A change applies from the account's next request, on every server.","operationId":"TeamController_update","parameters":[{"name":"display_id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateSyntheticAccountDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyntheticAccountEnvelopeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`, or `invalid_flow_profile`: `flow_profile` is not `fp_platform`, `fp_…` or `fp_…@N` (at most 72 characters), or not a live profile of this workspace with that version (an archived profile cannot be assigned).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission`: the caller lacks a permission the route needs, or sent `flow_profile` (any value, `null` included) without `flow.write`; nothing is written and an `outcome=denied` audit event names the permission.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Edit a synthetic account (label / role / notes / flow profile)","tags":["Team — synthetic accounts"],"x-required-scopes":["team.write"]},"delete":{"description":"Revokes the account's workspace membership and stamps `archived_at`; its access tokens answer 401 `session_revoked` from their next request. The row stays for audit. Calling on an already-archived account is a no-op (still 204).","operationId":"TeamController_archive","parameters":[{"name":"display_id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"204":{"description":"Archived.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Archive (soft-delete) a synthetic account","tags":["Team — synthetic accounts"],"x-required-scopes":["team.write"]}},"/v1/team/synthetic-accounts/{display_id}/rotate-password":{"post":{"description":"Sets a new password and signs the account out of every active session: its access tokens answer 401 `session_revoked` from their next request. Answers once the revocation second has passed. The new plaintext password is returned exactly once. On an email-mode account this switches it back to `credential_mode: \"generated\"` and any unused setup link stops working.","operationId":"TeamController_rotatePassword","parameters":[{"name":"display_id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"The new password, returned exactly once.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`credential_change_in_progress`: another change to this account's credentials (a setup link being used, a resend or restart, a rotation) is still running. Retry after `Retry-After` seconds. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited`: the authentication service's limit on verification and password-reset codes from your IP (5 a minute) ran out; each create or address change uses 2, a resend that signs the account out, a switch from a generated password or a password rotation 1. Nothing was sent; retry after `Retry-After` seconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Generate a new password for the synthetic account","tags":["Team — synthetic accounts"],"x-required-scopes":["team.write"]}},"/v1/team/synthetic-accounts/{display_id}/mfa":{"get":{"description":"Resolved live from the auth platform. `method` is the enabled factor type (`null` when MFA is off). `email_capable` says whether the account could use email codes at all — only accounts created with a base email have a deliverable mailbox; addresses on @agents.dispute.markets are a sink.","operationId":"TeamController_mfaStatus","parameters":[{"name":"display_id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Current MFA state of a synthetic account","tags":["Team — synthetic accounts"],"x-required-scopes":["team.read"]},"delete":{"description":"Disables every enrolled factor without provisioning a replacement — from the next sign-in the account authenticates with its password alone. Idempotent: calling it on an account with no MFA is a no-op (still 204). Re-enable any time via `rotate-mfa`, which returns fresh factor material.","operationId":"TeamController_disableMfa","parameters":[{"name":"display_id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"204":{"description":"MFA disabled.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`credential_change_in_progress`: another change to this account's credentials (a setup link being used, a resend or restart, a rotation) is still running. Retry after `Retry-After` seconds. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Disable MFA entirely on a synthetic account","tags":["Team — synthetic accounts"],"x-required-scopes":["team.write"]}},"/v1/team/synthetic-accounts/{display_id}/rotate-mfa":{"post":{"description":"By default preserves the factor type (TOTP stays TOTP, email stays email); pass `method` to switch types in the same rotation, or to enable MFA on an account that had none. Returns the new material exactly once — for TOTP the URI/secret/QR + recovery codes; for email just fresh recovery codes (sign-in codes are emailed on demand). The previous factor stops working immediately.","operationId":"TeamController_rotateMfa","parameters":[{"name":"display_id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RotateMfaDto"}}}},"responses":{"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`credential_mode_email`: the account's credentials are set by email (this would show you a TOTP secret). Send a new setup link, or switch to a generated password with rotate-password. `credential_change_in_progress`: another change to this account's credentials (a setup link being used, a resend or restart, a rotation) is still running. Retry after `Retry-After` seconds. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Disable every existing MFA factor and provision a fresh one","tags":["Team — synthetic accounts"],"x-required-scopes":["team.write"]}},"/v1/team/synthetic-accounts/{display_id}/rotate-credentials":{"post":{"description":"Burns every credential the bot may be holding: new password (revokes all sessions) AND a new MFA factor + recovery codes. The factor type is preserved unless `method` says otherwise. Returns the full bundle exactly once.","operationId":"TeamController_rotateAllCredentials","parameters":[{"name":"display_id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RotateMfaDto"}}}},"responses":{"200":{"description":"The new password and factor material, returned exactly once.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`credential_change_in_progress`: another change to this account's credentials (a setup link being used, a resend or restart, a rotation) is still running. Retry after `Retry-After` seconds. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited`: the authentication service's limit on verification and password-reset codes from your IP (5 a minute) ran out; each create or address change uses 2, a resend that signs the account out, a switch from a generated password or a password rotation 1. Nothing was sent; retry after `Retry-After` seconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Rotate password + MFA in a single round-trip","tags":["Team — synthetic accounts"],"x-required-scopes":["team.write"]}},"/v1/team/synthetic-accounts/{display_id}/revoke-sessions":{"post":{"description":"Owner only (a security action; API keys cannot call it). Every access token the account holds stops working: its next request answers 401 `session_revoked`. Signing in again works. Archiving the account and rotating its password or credentials revoke its sessions the same way. Takes effect on the account's very next request, on every server. The response is sent only once the cut-off's second has passed, so a sign-in made after it is never caught by the cut-off (tokens are second-precise). Recorded as `synthetic_account.revoke_sessions`.","operationId":"TeamController_revokeSessions","parameters":[{"name":"display_id","required":true,"in":"path","description":"The synthetic account (`sa_…`).","schema":{"example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeSessionsResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission`: only the workspace owner may revoke sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no synthetic account with this id in the workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`synthetic_account_archived`: the account is archived (its sessions were revoked then). Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Revoke every session of a synthetic account","tags":["Team — synthetic accounts"],"x-required-scopes":["team.write"]}},"/v1/team/synthetic-accounts/{display_id}/expire-sessions":{"post":{"description":"For testing how your client handles an expired session without waiting for the token to run out: every access token the account holds now answers 401 `session_expired` on its next request (distinct from `session_revoked`). Signing in again works. Needs `flow.write`: the owner, or a key the owner minted with the E2E preset; every other role gets 403. Synthetic accounts of this workspace only. For sessions that always expire after N seconds, use the `session.max_age` flow variant instead. Takes effect on the account's very next request, on every server. The response is sent only once the cut-off's second has passed, so a sign-in made after it is never caught by the cut-off (tokens are second-precise). Recorded as `synthetic_account.expire_sessions`.","operationId":"TeamSessionsController_expireSessions","parameters":[{"name":"display_id","required":true,"in":"path","description":"The synthetic account (`sa_…`).","schema":{"example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExpireSessionsResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no synthetic account with this id in the workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`synthetic_account_archived`: the account is archived. Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Expire the current sessions of a synthetic account (simulation)","tags":["Team — synthetic accounts"],"x-idempotent":"replay","x-required-scopes":["flow.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/team/members":{"get":{"description":"People only (owners and colleagues), never synthetic accounts. Cursor-paginated, oldest member first.","operationId":"PeopleController_list","parameters":[{"name":"cursor","required":false,"in":"query","description":"`pagination.next_cursor` of the previous page.","schema":{"type":"string"}},{"name":"limit","required":false,"in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberListDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`invalid_cursor`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no such person or invite in this workspace, or colleagues are not enabled for this workspace yet (`features.multi_workspace` on `GET /v1/auth/me` is false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"List the people of the workspace","tags":["Team — people"],"x-required-scopes":["team.read"]}},"/v1/team/members/{id}/removal-preview":{"get":{"description":"The synthetic accounts whose mail goes to them (each needs a disposition) or whose credentials they saw or set (reset unless archived), the webhooks, webhook sinks and playbooks they created (disabled unless kept), the people they invited, their pending invites and their API keys (which stop working), and whether a step-up is needed. Reads only.","operationId":"PeopleController_removalPreview","parameters":[{"name":"id","required":true,"in":"path","description":"The person's membership (`wm_…`).","schema":{"example":"wm_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemovalPreviewDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no such person or invite in this workspace, or colleagues are not enabled for this workspace yet (`features.multi_workspace` on `GET /v1/auth/me` is false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"What removing (or demoting) a person would affect","tags":["Team — people"],"x-required-scopes":["team.write"]}},"/v1/team/members/{id}":{"patch":{"description":"Takes effect on their next request, on every server. Promoting to owner, and demoting an owner, need a second factor proved within 5 minutes; promoting to `agent_full` within 15. Demoting an owner cancels the invites they sent and needs a disposition for each synthetic account whose mail goes to them (`synthetic_accounts`); every synthetic account whose credentials they saw or set is reset to credentials nobody knows unless archived (docs/15 §5.6). The owners as they were before the change get a security notice for any change to or from owner or `agent_full`. Recorded as `workspace_member.update`.","operationId":"PeopleController_update","parameters":[{"name":"id","required":true,"in":"path","description":"The person's membership (`wm_…`).","schema":{"example":"wm_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateMemberDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberEnvelopeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`; `disposition_required` (`details.synthetic_accounts`); `disposition_not_allowed` (`move_to_me` on an account not mailed to them, `details.synthetic_accounts`); `email_not_verified` (`move_to_me` needs a verified e-mail of yours). Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (owners only); `step_up_required` with `details.max_age_minutes` (5 for owner changes, 15 for `agent_full`): prove a second factor (`POST /v1/auth/mfa/step-up`), refresh the session (`POST /v1/auth/refresh`) and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no such person or invite in this workspace, or colleagues are not enabled for this workspace yet (`features.multi_workspace` on `GET /v1/auth/me` is false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`last_owner`: a workspace keeps at least one owner. `member_changed`: their role changed meanwhile; reload. `credential_change_in_progress`: a synthetic account's credentials are being changed right now; retry in a few seconds (the person was not removed or demoted). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"502":{"description":"`auth_misconfigured`: the authentication service did not let a synthetic account's credentials be reset, so the person was not removed or demoted; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Change a person's role","tags":["Team — people"],"x-idempotent":"replay","x-required-scopes":["team.write"]},"delete":{"description":"Their next request in this workspace answers 401 `account_revoked` (their sign-in and their other workspaces are untouched); their API keys here stop working at once, with the webhooks and playbooks bound to them; the invites they sent are cancelled and their running background tasks here are cancelled. Send a disposition for each synthetic account whose mail goes to them (`move_to_me` or `archive`, else 400 `disposition_required`); `move_to_me` also resets its credentials. Every other synthetic account whose credentials they saw or set is reset to credentials nobody knows (`rotate`, the default) unless you send `archive` (docs/15 §5.6); and list the webhooks, sinks and playbooks they created that you `keep` (the rest are disabled). See `removal-preview`. Removing an owner needs a second factor proved within 5 minutes, and the owners get a security notice; the removed person gets one too. To leave yourself, use leave. Recorded as `workspace_member.remove`, plus one row per disposition.","operationId":"PeopleController_remove","parameters":[{"name":"id","required":true,"in":"path","description":"The person's membership (`wm_…`).","schema":{"example":"wm_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoveMemberDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemovalResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`; `disposition_required` (`details.synthetic_accounts`); `disposition_not_allowed` (`move_to_me` on an account not mailed to them, `details.synthetic_accounts`); `email_not_verified` (`move_to_me` needs a verified e-mail of yours). Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (owners only); `step_up_required` with `details.max_age_minutes` (5 for owner changes, 15 for `agent_full`): prove a second factor (`POST /v1/auth/mfa/step-up`), refresh the session (`POST /v1/auth/refresh`) and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no such person or invite in this workspace, or colleagues are not enabled for this workspace yet (`features.multi_workspace` on `GET /v1/auth/me` is false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`last_owner`: the last owner cannot be removed. `cannot_remove_self`: use leave. `credential_change_in_progress`: a synthetic account's credentials are being changed right now; retry in a few seconds (the person was not removed or demoted). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"502":{"description":"`auth_misconfigured`: the authentication service did not let a synthetic account's credentials be reset, so the person was not removed or demoted; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Remove a person from the workspace","tags":["Team — people"],"x-idempotent":"replay","x-required-scopes":["team.write"]}},"/v1/team/synthetic-accounts/{display_id}/move-mail":{"post":{"description":"Its sign-in address moves onto one of your verified e-mails (same `agent-…` tag when free; an address on the agents.dispute.markets sink keeps its address), you become the person its setup, reset and sign-in mail goes to, and any unused setup link stops working. Its password, sessions and factors are unchanged: send a new setup link afterwards if needed. Recorded as `synthetic_account.move_mail` (`reason: requested`).","operationId":"PeopleController_moveMail","parameters":[{"name":"display_id","required":true,"in":"path","description":"The synthetic account (`sa_…`).","schema":{"example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MoveMailResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`email_not_verified`: you have no verified e-mail that can receive mail. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no such person or invite in this workspace, or colleagues are not enabled for this workspace yet (`features.multi_workspace` on `GET /v1/auth/me` is false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`synthetic_account_archived`; `email_taken`; `credential_change_in_progress`. Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Move a synthetic account's mail to me","tags":["Team — people"],"x-idempotent":"replay","x-required-scopes":["team.write"]}},"/v1/team/invites":{"get":{"description":"Pending, accepted, expired, cancelled and bounced invites of the last 30 days, newest first. Cursor-paginated: follow `pagination.next_cursor` until `has_more` is false. Never the link.","operationId":"PeopleController_listInvites","parameters":[{"name":"cursor","required":false,"in":"query","description":"`pagination.next_cursor` of the previous page.","schema":{"type":"string"}},{"name":"limit","required":false,"in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InviteListDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`invalid_cursor`; `validation_failed` (`limit`). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no such person or invite in this workspace, or colleagues are not enabled for this workspace yet (`features.multi_workspace` on `GET /v1/auth/me` is false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"List invites","tags":["Team — people"],"x-required-scopes":["team.read"]},"post":{"description":"Mails a single-use link from notifications@dispute.markets, valid 7 days (72 hours for an owner). The answer is the same whether or not the address has an account. The person must accept with this exact address verified on their account. Inviting an owner needs a second factor proved within 5 minutes, `agent_full` within 15. You need a verified e-mail yourself. `send_status: send_failed` when the mail service refused it (resend it). Recorded as `workspace_invite.create`.","operationId":"PeopleController_createInvite","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateInviteDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InviteEnvelopeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`; `synthetic_address`: the sign-in address of one of this workspace's synthetic accounts; `email_not_verified`: verify your own e-mail first. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (owners only); `step_up_required` with `details.max_age_minutes` (5 for owner changes, 15 for `agent_full`): prove a second factor (`POST /v1/auth/mfa/step-up`), refresh the session (`POST /v1/auth/refresh`) and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no such person or invite in this workspace, or colleagues are not enabled for this workspace yet (`features.multi_workspace` on `GET /v1/auth/me` is false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`already_a_member` (that address belongs to a person in this workspace); `invite_pending` (`details.invite_id`: resend it instead); `invite_pending_limit` (25 pending invites); `member_limit_reached` (50 people); `invite_undeliverable` (mail to this address cannot be delivered); `invite_paused` (`details.retry_after_s`: a recipient marked one of your invites as spam; inviting is paused for 24 h in every workspace). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`invite_rate_limited` with `details.retry_after_s` (and `Retry-After`): 60 s between sends to one address; 3 per address per 24 h (per workspace and per inviter); 20 per workspace per hour, 60 per day; 30 per inviter per day across all their workspaces (5 for an account younger than 7 days or without a second factor).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`invite_unavailable`: invites are unavailable right now (mail not configured, or the service-wide daily cap is reached). Nothing was sent.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Invite someone by e-mail","tags":["Team — people"],"x-idempotent":"replay","x-required-scopes":["team.write"]}},"/v1/team/invites/{id}/resend":{"post":{"description":"A new link with a fresh expiry replaces the old one, which stops working (410 `invite_revoked`). The answer is the new invite (a new `id`). Same limits and step-up as inviting. Recorded as `workspace_invite.resend`.","operationId":"PeopleController_resend","parameters":[{"name":"id","required":true,"in":"path","description":"The invite (`wi_…`).","schema":{"example":"wi_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResendInviteDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InviteEnvelopeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (owners only); `step_up_required` with `details.max_age_minutes` (5 for owner changes, 15 for `agent_full`): prove a second factor (`POST /v1/auth/mfa/step-up`), refresh the session (`POST /v1/auth/refresh`) and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no such person or invite in this workspace, or colleagues are not enabled for this workspace yet (`features.multi_workspace` on `GET /v1/auth/me` is false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`invite_not_pending`: it was accepted or cancelled. `already_a_member` (that address belongs to a person in this workspace); `invite_pending` (`details.invite_id`: resend it instead); `invite_pending_limit` (25 pending invites); `member_limit_reached` (50 people); `invite_undeliverable` (mail to this address cannot be delivered); `invite_paused` (`details.retry_after_s`: a recipient marked one of your invites as spam; inviting is paused for 24 h in every workspace). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`invite_rate_limited` with `details.retry_after_s` (and `Retry-After`): 60 s between sends to one address; 3 per address per 24 h (per workspace and per inviter); 20 per workspace per hour, 60 per day; 30 per inviter per day across all their workspaces (5 for an account younger than 7 days or without a second factor).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`invite_unavailable`: invites are unavailable right now (mail not configured, or the service-wide daily cap is reached). Nothing was sent.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Send an invite again","tags":["Team — people"],"x-idempotent":"replay","x-required-scopes":["team.write"]}},"/v1/team/invites/{id}":{"delete":{"description":"Its link stops working (410 `invite_revoked`). Recorded as `workspace_invite.revoke` (`reason: revoked`).","operationId":"PeopleController_revokeInvite","parameters":[{"name":"id","required":true,"in":"path","description":"The invite (`wi_…`).","schema":{"example":"wi_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"204":{"description":"Cancelled.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: no such person or invite in this workspace, or colleagues are not enabled for this workspace yet (`features.multi_workspace` on `GET /v1/auth/me` is false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`invite_not_pending`: already accepted or cancelled. Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Cancel a pending invite","tags":["Team — people"],"x-idempotent":"replay","x-required-scopes":["team.write"]}},"/v1/auth/invites/inspect":{"post":{"description":"Public (the token is the credential). Returns the workspace, its environment, the role, the inviter's e-mail, the expiry and the invited address masked (`d•••@acme.com`). Never says whether the address has an account. Consumes nothing.","operationId":"InvitesController_inspect","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InviteTokenDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InviteInspectionDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`invite_invalid`: no such invite (check the whole link was copied).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"410":{"description":"`invite_expired` (ask someone at the workspace for a new invite), `invite_used` (already accepted) or `invite_revoked` (cancelled, replaced by a newer invite, sent by someone who is no longer an owner, or the workspace is gone).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one invite. See `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"summary":"What an invite link is for","tags":["Auth"]}},"/v1/auth/invites/accept":{"post":{"description":"Signed in (with or without a current workspace). The invited address must be a verified e-mail of your account; then you become a member with the invite's role, the owners get a notice, and the answer carries a session switched into the workspace. Uses the invite once. Synthetic accounts cannot join. Recorded as `workspace_invite.accept` in the invited workspace (refusals of a known invite as `failed`).","operationId":"InvitesController_accept","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InviteTokenDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptInviteResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`invite_email_mismatch`: the invited address is not a verified e-mail of your account (add and verify it under `/v1/me/emails`, or sign in with the account it belongs to); `synthetic_account_not_allowed`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`invite_invalid`: no such invite (check the whole link was copied).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`already_a_member` (the invite stays usable); `membership_limit_reached` (you belong to 50 workspaces); `member_limit_reached` (the workspace has 50 people). Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"410":{"description":"`invite_expired` (ask someone at the workspace for a new invite), `invite_used` (already accepted) or `invite_revoked` (cancelled, replaced by a newer invite, sent by someone who is no longer an owner, or the workspace is gone).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one invite. See `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"502":{"description":"`auth_unavailable`: the authentication service could not add you. The invite was not used; try again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Join a workspace with an invite","tags":["Auth"]}},"/v1/me/workspaces":{"get":{"description":"Every workspace you belong to, with your role, its environment label, its people count and its owners' e-mails (so you know whom to ask), in pipeline order. Read from dispute.markets only. A synthetic account gets its one workspace and nothing about its people.","operationId":"WorkspacesController_list","parameters":[{"name":"cursor","required":false,"in":"query","description":"`pagination.next_cursor` of the previous page.","schema":{"type":"string"}},{"name":"limit","required":false,"in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceListDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`invalid_cursor`; `validation_failed` (`limit`). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: several workspaces per person are not enabled for you yet (`features.multi_workspace` on `GET /v1/auth/me` is false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"List your workspaces","tags":["Workspaces"]}},"/v1/workspaces":{"post":{"description":"A new, empty workspace with default settings, owned by you; the answer carries a session switched into it. Typical use: one workspace per environment (Development, Staging, Production). API keys, webhooks, flow profiles and data are never shared between workspaces; `copy_settings_from` copies only default currency and time zone. Your own preferences come along from the workspace this session is in. Limits: 10 workspaces you created and still own, 5 creations a day, 50 memberships. Needs a verified e-mail; synthetic accounts cannot create workspaces. Recorded as `tenant.create` (`source: create`) in the new workspace, and `tenant.copy_settings` in the one copied from.","operationId":"WorkspacesController_create","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`. This response holds a secret or a signed URL and is never stored: a retry with the same key is 409 `idempotency_secret_not_replayable` with `details.resource_id`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateWorkspaceDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateWorkspaceResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`synthetic_account_not_allowed`; `email_not_verified`: verify your e-mail first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`copy_settings_from`: `workspace_not_found`: no such workspace, it was deleted, or you are not a member of it (the same answer for all three). Also `not_found` when the feature is not enabled for you (`features.multi_workspace` false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_limit_reached` (`details.limit`: you created and still own 10; delete one you no longer need); `membership_limit_reached` (you belong to 50); `workspace_create_in_progress` (`details.retry_after_s`: another create of yours is running); `idempotency_secret_not_replayable` (`details.resource_id`: the workspace a retry with this key created). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`workspace_create_rate_limited` with `details.retry_after_s` and `Retry-After`: 5 creations per 24 hours.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"502":{"description":"`auth_unavailable`: the authentication service failed; nothing was created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Create a workspace","tags":["Workspaces"],"x-idempotent":"no_replay"}},"/v1/workspaces/{id}/deletion-preview":{"get":{"description":"For the delete confirm dialog: the workspace's name (to type), its environment label, how much it holds and whether the delete needs a second factor from the last 5 minutes. An empty workspace (no transactions, disputes, reports, webhooks, synthetic accounts or API keys) whose only member is you needs none. Owners only.","operationId":"WorkspacesController_deletionPreview","parameters":[{"name":"id","required":true,"in":"path","description":"The workspace (`tnt_…`).","schema":{"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeletionPreviewDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission`: only owners can delete a workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`workspace_not_found`: no such workspace, it was deleted, or you are not a member of it (the same answer for all three). Also `not_found` when the feature is not enabled for you (`features.multi_workspace` false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"What deleting a workspace would remove","tags":["Workspaces"]}},"/v1/workspaces/{id}":{"delete":{"description":"Deletes the workspace at once for everyone: every member's next request in it answers 401 `account_revoked` (their sign-in and other workspaces are untouched), its API keys answer 401, its webhooks are disabled, its scheduled jobs and background tasks stop and its pending invites are cancelled. Every member gets a notice by e-mail. The data is kept for 30 days (`purge_after`) and then purged for good, together with its synthetic accounts; the audit trail stays. Type the name in `confirm_name`. A second factor from the last 5 minutes is required (`POST /v1/auth/mfa/step-up`, then `POST /v1/auth/refresh`), except for an empty workspace whose only member is you (see `GET /v1/workspaces/{id}/deletion-preview`). Owners only; deleting your only workspace is allowed. When the session was in it, the answer carries tokens for your next workspace. Recorded as `tenant.delete` in that workspace.","operationId":"WorkspacesController_deleteWorkspace","parameters":[{"name":"id","required":true,"in":"path","description":"The workspace (`tnt_…`).","schema":{"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteWorkspaceDto"}}}},"responses":{"202":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteWorkspaceResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`confirm_name_mismatch`: `confirm_name` is not the workspace's name. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`step_up_required` (`details.max_age_minutes`: 5): prove a second factor first; `missing_permission`: only owners can delete a workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`workspace_not_found`: no such workspace, it was deleted, or you are not a member of it (the same answer for all three). Also `not_found` when the feature is not enabled for you (`features.multi_workspace` false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Delete a workspace","tags":["Workspaces"],"x-idempotent":"replay"}},"/v1/auth/switch-workspace":{"post":{"description":"Returns new tokens for the session, in the workspace you name; your next sign-in lands there too. Use them for every following call: ids belong to one workspace, so start from the dashboard rather than a deep link. Your second-factor proof (`mfa_at`) carries over unchanged. Synthetic accounts cannot switch. Recorded as `auth.switch_workspace` in the workspace switched to.","operationId":"WorkspacesController_switchWorkspace","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SwitchWorkspaceDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionTokensDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`workspace_switch_not_allowed`: a synthetic account.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`workspace_not_found`: no such workspace, it was deleted, or you are not a member of it (the same answer for all three). Also `not_found` when the feature is not enabled for you (`features.multi_workspace` false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"502":{"description":"`auth_unavailable`: the authentication service refused the switch; try again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Switch your session to another workspace","tags":["Workspaces","Auth"]}},"/v1/me/workspaces/{id}/leave":{"post":{"description":"You stop being a member at once: requests in it answer 401 `account_revoked` (your sign-in and other workspaces are untouched), your API keys there stop working, the invites you sent there are cancelled, your running background tasks there are cancelled and the webhooks, webhook sinks and playbooks you created there are disabled. Archive each synthetic account whose mail goes to you (`synthetic_accounts`), or ask another owner to move its mail first. Every other synthetic account whose credentials you saw or set (a generated password you were shown, a setup link you completed) has its credentials reset to ones nobody knows, unless you archive it (docs/15 §5.6); you are never shown anything. The last owner cannot leave: make someone else an owner first (or delete the workspace). When the session was in that workspace, the answer carries tokens for your next workspace. Recorded as `workspace_member.leave` in that workspace.","operationId":"WorkspacesController_leave","parameters":[{"name":"id","required":true,"in":"path","description":"The workspace (`tnt_…`).","schema":{"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeaveWorkspaceDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeaveResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`synthetic_account_not_allowed`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`workspace_not_found`: no such workspace, it was deleted, or you are not a member of it (the same answer for all three). Also `not_found` when the feature is not enabled for you (`features.multi_workspace` false).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`last_owner`: a workspace keeps at least one owner. `synthetic_mail_owner` (`details.synthetic_accounts`): synthetic accounts there still get their mail at your address; archive them or have another owner move their mail. `credential_change_in_progress`: a synthetic account's credentials are being changed right now; retry in a few seconds (you have not left). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"502":{"description":"`auth_misconfigured`: the authentication service did not let a synthetic account's credentials be reset, so you have not left; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Leave a workspace","tags":["Workspaces"],"x-idempotent":"replay"}},"/v1/me/invites":{"get":{"description":"Pending invites sent to one of your verified e-mail addresses (the proof accepting needs), for workspaces you are not in yet: how to get back to an invite after closing the tab, changing device or losing the mail. Never the link. Empty for a synthetic account.","operationId":"WorkspacesController_myInvites","parameters":[{"name":"cursor","required":false,"in":"query","description":"`pagination.next_cursor` of the previous page.","schema":{"type":"string"}},{"name":"limit","required":false,"in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MyInviteListDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`invalid_cursor`; `validation_failed` (`limit`). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Invites waiting for you","tags":["Workspaces"]}},"/v1/me/invites/{id}/accept":{"post":{"description":"Same rules as accepting with the link: you become a member with the invite's role, the owners get a notice, and the answer carries a session switched into the workspace. Recorded as `workspace_invite.accept` in that workspace (refusals of your invite as `failed`).","operationId":"WorkspacesController_acceptMine","parameters":[{"name":"id","required":true,"in":"path","description":"The invite (`wi_…`) from `GET /v1/me/invites`.","schema":{"example":"wi_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptInviteResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`synthetic_account_not_allowed`; `invite_email_mismatch` (the address is no longer verified on your account).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`invite_invalid`: no pending invite with this id for one of your verified addresses.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`already_a_member`; `membership_limit_reached` (you belong to 50 workspaces); `member_limit_reached` (the workspace has 50 people). Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"410":{"description":"`invite_expired`, `invite_used` or `invite_revoked` (it changed since it was listed).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"502":{"description":"`auth_unavailable`: the invite was not used; try again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Accept one of your invites","tags":["Workspaces"]}},"/v1/auth/signup":{"post":{"description":"Audited: `tenant.create`, then `auth.signup`. With `invite_token` no workspace is created: the answer is a session without one, and nothing is recorded until the invite is accepted (`workspace_invite.accept` with `created_account: true`).","operationId":"AuthController_signup","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignupDto"}}}},"responses":{"201":{"description":"The new session. Without `invite_token` it acts in the new sandbox workspace; with one it has no workspace until the invite is accepted (then `GET /v1/auth/me` answers `workspace: null`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthTokensDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`invite_invalid`: `invite_token` is no invite (nothing was created).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"410":{"description":"`invite_expired`, `invite_used` or `invite_revoked`: the invite can no longer be used (nothing was created).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Sign up and create a sandbox tenant","tags":["Auth"]}},"/v1/auth/signin":{"post":{"description":"Returns tokens, or an MFA challenge (`mfa_required: true`). Audited: `auth.signin` (`success`; `failed` only for a tenant member, written just after the response and coalesced per identifier per minute).","operationId":"AuthController_signin","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SigninDto"}}}},"responses":{"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Sign in with username or e-mail and password","tags":["Auth"]}},"/v1/auth/mfa/send-code":{"post":{"description":"Audited: `mfa.send_code` (when the challenge came from a member sign-in).","operationId":"AuthController_mfaSendCode","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaSendCodeDto"}}}},"responses":{"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Send an e-mail MFA code for a sign-in challenge","tags":["Auth"]}},"/v1/auth/mfa/verify":{"post":{"description":"Audited: `mfa.verify` (`success`; a wrong code is `failed`, written just after the response and coalesced per challenge per minute).","operationId":"AuthController_mfaVerify","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaVerifyDto"}}}},"responses":{"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Answer a sign-in MFA challenge with a code","tags":["Auth"]}},"/v1/auth/mfa/recover":{"post":{"description":"Audited: `mfa.recover` (`failed` as for `mfa.verify`). The code is never recorded.","operationId":"AuthController_mfaRecover","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaRecoverDto"}}}},"responses":{"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Answer a sign-in MFA challenge with a recovery code","tags":["Auth"]}},"/v1/auth/mfa/factors":{"get":{"operationId":"AuthController_listFactors","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"tags":["Auth"]},"post":{"description":"Audited: `mfa_factor.create` (the enrollment secret is never recorded).","operationId":"AuthController_startFactorEnrollment","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StartFactorEnrollmentDto"}}}},"responses":{"201":{"description":"","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Start enrolling an MFA factor","tags":["Auth"]}},"/v1/auth/mfa/factors/{id}/verify":{"post":{"description":"Audited: `mfa_factor.verify` (recovery codes are never recorded).","operationId":"AuthController_confirmFactorEnrollment","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfirmFactorEnrollmentDto"}}}},"responses":{"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Verify a pending MFA factor with two consecutive codes","tags":["Auth"]}},"/v1/auth/mfa/factors/{id}":{"delete":{"description":"Audited: `mfa_factor.delete`.","operationId":"AuthController_disableFactor","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"204":{"description":"","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Remove an MFA factor","tags":["Auth"]}},"/v1/auth/mfa/recovery-codes/regenerate":{"post":{"description":"Audited: `recovery_codes.regenerate` with the count only.","operationId":"AuthController_regenerateRecoveryCodes","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"201":{"description":"","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Regenerate MFA recovery codes","tags":["Auth"]}},"/v1/auth/mfa/step-up/send-code":{"post":{"description":"Sends a single-use 6-digit code to one of your enabled `email` factors; answer it with `POST /v1/auth/mfa/step-up`. Codes expire after 5 minutes and sends are throttled per address (30 s). Audited: `mfa.send_code` (the code is never recorded).","operationId":"AuthController_stepUpSendCode","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StepUpSendCodeDto"}}}},"responses":{"200":{"description":"The code was sent.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StepUpSendCodeResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"No enabled e-mail factor on the account (or `factor_id` is not one). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"410":{"description":"The factor's address is no longer verified.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"E-mail a step-up code to the signed-in user","tags":["Auth"]}},"/v1/auth/mfa/step-up":{"post":{"description":"Verifies a code from an authenticator, an e-mailed step-up code or a recovery code, and marks this session as having proved a second factor now. Needed before creating or rotating an API key when the last proof is older than 15 minutes (403 `step_up_required`). Audited: `mfa.step_up` (`success`; a wrong code answers 401 and is `failed` with `error_code` `invalid_code`, coalesced per user per minute).","operationId":"AuthController_stepUp","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StepUpDto"}}}},"responses":{"201":{"description":"The session proved a second factor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StepUpResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. Also: the code matched no factor (`unauthorized`); an `outcome=failed` `mfa.step_up` event (`invalid_code`) is then written in your workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Re-prove MFA (step-up)","tags":["Auth"]}},"/v1/auth/refresh":{"post":{"description":"Audited only on failure: `auth.refresh` `failed`, when the refresh token was issued for a known workspace.","operationId":"AuthController_refresh","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RefreshDto"}}}},"responses":{"201":{"description":"","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Exchange a refresh token for a new token pair","tags":["Auth"]}},"/v1/auth/bootstrap":{"post":{"description":"Audited: `tenant.create` when a tenant is created, then `auth.bootstrap`. A person with a live membership re-enters their default workspace (`created: false`); one with none gets a new workspace, under the same per-person lock and limits as `POST /v1/workspaces` (10 owned, 5 created a day by any route, deleted ones included) and only with a verified primary e-mail. A team member (synthetic account, live or deleted) cannot create a workspace: 403 `already_a_member`, recorded as `auth.bootstrap` `denied` in the workspace it belongs to.","operationId":"AuthController_bootstrap","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BootstrapDto"}}}},"responses":{"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`already_a_member`: the caller is a member (synthetic account) of a workspace, so it cannot create one. An `outcome=denied` `auth.bootstrap` event is written in that workspace. `email_not_verified`: a new workspace needs a verified primary e-mail.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_limit_reached` (`details.limit`): the caller already owns the most workspaces they may create. `workspace_create_in_progress` (`Retry-After`): another workspace is being created for the caller right now. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`workspace_create_rate_limited` (`Retry-After`, `details.retry_after_s`): the caller had the most workspaces a day created for them (any route, deleted ones included).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Create (or re-enter) the signed-in user's tenant","tags":["Auth"]}},"/v1/auth/me":{"get":{"description":"Who is signed in, whether it is a person (`is_human`), the workspace the session acts in with its environment label (`workspace`, null for a session without one), the permissions there, the workspace settings and preferences, and `features.multi_workspace`. Sessions only: an API key gets 401 `api_key_not_allowed` (use `GET /v1/whoami`). The camelCase aliases of the older fields (`emailVerified`, `tenantRole`, …) still come with the answer, as on every legacy resource (see the conventions page).","operationId":"AuthController_me","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthMeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`. An API key is refused with `api_key_not_allowed`: this route needs a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"The signed-in account and its current workspace","tags":["Auth"]}},"/v1/auth/verify-email/resend":{"post":{"description":"Audited: `email_verification.resend` (the address is never recorded).","operationId":"AuthController_resendVerification","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"201":{"description":"","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Re-send the e-mail verification code","tags":["Auth"]}},"/v1/auth/verify-email/confirm":{"post":{"description":"Audited: `email_verification.confirm` (the code is never recorded).","operationId":"AuthController_confirmVerification","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyEmailDto"}}}},"responses":{"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Verify the account e-mail with its code","tags":["Auth"]}},"/v1/auth/forgot-password":{"post":{"description":"Always `{ok: true}`. Audited: `password.forgot` for a tenant member's address, written just after the response; the correlation id is kept only as `metadata.unverified_correlation_id`.","operationId":"AuthController_forgotPassword","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForgotPasswordDto"}}}},"responses":{"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Request a password-reset e-mail","tags":["Auth"]}},"/v1/auth/reset-password":{"post":{"description":"Not audited yet (`password.reset` cannot be attributed to a workspace).","operationId":"AuthController_resetPassword","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResetPasswordDto"}}}},"responses":{"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one identifier (account, e-mail or MFA challenge). Same body for known and unknown identifiers; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Set a new password with a reset code","tags":["Auth"]}},"/v1/me/emails":{"get":{"operationId":"MeEmailsController_list","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"Email contacts, verified or not.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"List the user's email addresses","tags":["Me — emails"]},"post":{"description":"Idempotent per address: a new email is registered against the account and a 6-digit code is emailed to it; an already-added-but-unverified email just gets a fresh code; an already-verified email is a no-op. 409 when another account holds the address. Audited: `user_email.create` (`existing`, `sent`; never the address).","operationId":"MeEmailsController_addOrResend","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddEmailDto"}}}},"responses":{"200":{"description":"`{ email, verified, sent }` — `sent` is true when a code was dispatched.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"Email belongs to another account. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Add an email (or re-send its verification code)","tags":["Me — emails"]}},"/v1/me/emails/verify":{"post":{"description":"Consumes the code emailed on add/resend and flips the contact to verified. Audited: `user_email.verify`.","operationId":"MeEmailsController_verify","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyEmailCodeDto"}}}},"responses":{"200":{"description":"`{ ok: true }`.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Invalid or expired code. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`too_many_attempts`: more than 20 code attempts per minute from one client IP, or 10 for one account; see `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Submit the 6-digit code for a pending email","tags":["Me — emails"]}},"/v1/me/emails/{id}":{"delete":{"description":"Audited: `user_email.delete` (target: the contact id).","operationId":"MeEmailsController_remove","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"204":{"description":"Removed.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Remove an email from the account","tags":["Me — emails"]}},"/v1/auth/account-setup/inspect":{"post":{"description":"Public (the token is the credential). Returns the account the link sets a password for. Consumes nothing, so it is safe to call when the setup page opens.","operationId":"AccountSetupController_inspect","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupTokenDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupDetailsDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"404":{"description":"`setup_link_invalid`: no such link (check the whole link was copied).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"410":{"description":"`setup_link_expired` (72 hours passed; ask the workspace owner for a new one), `setup_link_used` (already used: sign in, or use forgot-password) or `setup_link_revoked` (a newer link was sent, or the account was archived or switched to a generated password).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one link. See `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}}},"summary":"What a setup link is for","tags":["Auth"]}},"/v1/auth/account-setup/complete":{"post":{"description":"Public (the token is the credential). Uses the link once: sets the password (Auth applies its password policy and breach check, and ends every session), then sets up the two-factor factor the owner chose and returns its material exactly once. A password Auth refuses is 400 `password_rejected` and leaves the link usable. If the password is set but the factor cannot be, the answer is 502 `mfa_setup_failed`: the owner must send a new link. Recorded as `synthetic_account.complete_setup` with the synthetic account as the actor.","operationId":"AccountSetupController_complete","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteSetupDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupCompletedDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"400":{"description":"`validation_failed`; `password_rejected`: Auth refused the password (`details.reason` says why); the link stays usable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"404":{"description":"`setup_link_invalid`: no such link (check the whole link was copied).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"409":{"description":"`credential_change_in_progress`: the workspace owner is changing this account's credentials right now (for example sending a new link). The link was not used; retry after `Retry-After` seconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"410":{"description":"`setup_link_expired` (72 hours passed; ask the workspace owner for a new one), `setup_link_used` (already used: sign in, or use forgot-password) or `setup_link_revoked` (a newer link was sent, or the account was archived or switched to a generated password).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"429":{"description":"`too_many_attempts`: more than 20 attempts per minute from one client IP, or 10 for one link, or the authentication service's limit on password-reset codes from the client IP (5 a minute) ran out. The link was not used. See `Retry-After`. No audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"502":{"description":"`mfa_setup_failed`: the password is set, but the two-factor factor could not be. Ask the workspace owner to send a new setup link. `auth_misconfigured`: the authentication service refused the request dispute.markets made for you. The link was not used; retry later, and quote `request_id` if it persists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"503":{"description":"`auth_unavailable`: the authentication service is unavailable or did not answer. The link was not used; retry after `Retry-After` seconds. `service_unavailable`: dispute.markets is temporarily unavailable; see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}}},"summary":"Set the password with a setup link","tags":["Auth"]}},"/v1/dev/generate":{"post":{"description":"Returns the job (`id: gj_…`) at once; the rows are created in the background in chunks of 500 transactions, which survive server restarts. Poll `GET /v1/dev/generate/:id` (it reports `progress` and, after two chunks, `eta_at`) until `status` (`pending`, `running`) is `completed`, `failed` or `canceled` (`error` and `error_code` then say why), or wait on its chunks with `GET /v1/scheduled-jobs?generate_job_id=`. Every transaction and dispute it creates is stamped with the job, so `GET /v1/disputes?generate_job_id=` lists only them, a targeted advance-lifecycle moves only them, and `POST /v1/dev/generate-jobs/:id/cleanup` deletes only them. The job records the request's X-Correlation-Id and X-Request-Id.\n\nThe request's flow profile (`X-DM-Flow`, else the workspace default) is stamped on the job: `generate.profile` chooses the mix (`actionable`: only disputes waiting on you, with `deadline_anchor: now` deadlines ahead of the run), reason codes, currencies and edge amounts; `generate.trickle` creates the disputes a batch a minute instead of all at once (`created_so_far`, `trickle` and `eta_at` on the job). Without a profile the output is today's for a given seed.","operationId":"DevController_generate","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateDto"}}}},"responses":{"202":{"description":"The job was created and is running in the background.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateJobResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`, e.g. `count` above the caller's limit. `lifecycle_conflict`: `lifecycle: manual` with a flow profile that sets `lifecycle.windows` or `lifecycle.review`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`generate_in_progress`: the tenant's unfinished jobs plus this `count` would exceed 20,000 transactions, or, for an API key, the unfinished jobs started by API keys would exceed 5,000 (`details`: `in_flight`, `requested`, `limit`, `scope` `tenant` or `api_key`; retry after `Retry-After`). `reset_in_progress`: a reset of the tenant is queued or running (retry after `Retry-After`). `tenant_data_limit`: the tenant holds 50,000 disputes; clean up first. Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Retry-After":{"description":"Seconds to wait before retrying (on `generate_in_progress`).","schema":{"type":"integer","example":2}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Start a synthetic-data generate job (async)","tags":["Dev — synthetic data"],"x-idempotent":"replay","x-required-scopes":["dev.generate"],"x-api-key":true,"x-key-grantable":true}},"/v1/dev/generate/{id}":{"get":{"description":"Status of a generate job: `progress` (transactions committed of the total), `created_so_far`, `started_at`, `eta_at` (after the second chunk, while running; for a trickle, when its last batch runs), `trickle` (batches total and done of a `generate.trickle` job) and, when it did not complete, `error_code`. Once it has completed, `dispute_ids` lists the disputes it created (that still exist).","operationId":"DevController_generateStatus","parameters":[{"name":"id","required":true,"in":"path","description":"The generate job id (`gj_…`); the deprecated uuid `job_id` is accepted too.","schema":{"example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateJobResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"No such job in the caller's tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a generate job","tags":["Dev — synthetic data"],"x-required-scopes":["dev.generate"],"x-api-key":true,"x-key-grantable":true}},"/v1/dev/generate-jobs/{id}/cleanup":{"post":{"description":"Deletes the job's transactions and, with them, their disputes, dispute events, evidence rows and payment events, in short batches. A job still running is canceled first (it ends `canceled`) and its committed rows are deleted. Nothing else in the tenant is touched, so parallel test runs can each clean up their own fixtures. Idempotent: a second call returns zeros. The job record itself is kept.\n\nA job holding at most 2,000 transactions is cleaned up in this request (200, with the counts and the `generate_job.cleanup` audit row). A bigger one becomes a `generate.cleanup` background task of 500-transaction chunks (202): the last chunk writes the audit row with the totals and the task's `result.counts`. `async` in the body forces either behaviour. While a background cleanup of the job is queued or running, another call returns it (202), or 409 `cleanup_in_progress` with `async: false`.","operationId":"DevController_cleanup","parameters":[{"name":"id","required":true,"in":"path","description":"The generate job id (`gj_…`); the deprecated uuid `job_id` is accepted too.","schema":{"example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CleanupDto"}}}},"responses":{"200":{"description":"Cleaned up in the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CleanupResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"202":{"description":"Cleaning up in the background.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CleanupAcceptedDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`invalid_generate_job_id`: not a `gj_…` id or uuid. `validation_failed`: `async` is not a boolean. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"No such job in the caller's tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`cleanup_in_progress`: `async: false`, but a background cleanup of this job is queued or running (`details.scheduled_job_id`; retry after `Retry-After`). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"integer","example":5}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Delete exactly what one generate job created","tags":["Dev — synthetic data"],"x-idempotent":"replay","x-required-scopes":["dev.generate"],"x-api-key":true,"x-key-grantable":true}},"/v1/dev/generate-jobs/{id}/cancel":{"post":{"description":"Stops a `pending` or `running` job: its remaining chunks are canceled (a chunk running right now commits nothing) and the job ends `canceled`. The transactions of the chunks that already committed are kept (`rows_done`); clean them up with `POST /v1/dev/generate-jobs/:id/cleanup`, which is allowed at once. A job that already finished is returned unchanged (200). Recorded as `generate_job.cancel`.","operationId":"DevController_cancel","parameters":[{"name":"id","required":true,"in":"path","description":"The generate job id (`gj_…`); the deprecated uuid `job_id` is accepted too.","schema":{"example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"The job after the cancel (or unchanged, if it had finished).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelGenerateJobResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`invalid_generate_job_id`: not a `gj_…` id or uuid. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"No such job in the caller's tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Cancel a generate job","tags":["Dev — synthetic data"],"x-idempotent":"replay","x-required-scopes":["dev.generate"],"x-api-key":true,"x-key-grantable":true}},"/v1/dev/reset":{"post":{"description":"Tenant-wide: it also wipes the fixtures of any other test run in progress. Tests should use `POST /v1/dev/generate-jobs/:id/cleanup` instead. Runs as a `dev.reset` background task (202): unfinished generate jobs are canceled, then transactions, disputes (with their events and evidence), payment events and reports are deleted in batches of 1,000 rows per table, each in its own short transaction. Follow it in `GET /v1/me/background-tasks` (`background_task_id`); when it has `succeeded`, `result.counts.deleted` is the number of rows deleted. While it is queued or running, `POST /v1/dev/generate` answers 409 `reset_in_progress`, and another reset returns this one (200). The audit trail is not touched; the reset is recorded once, as `tenant_data.reset` with the totals, when its last batch has committed. Owners only; never with an API key.","operationId":"DevController_reset","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"A reset was already queued or running: that one is returned.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResetAcceptedDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"202":{"description":"The reset was queued.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResetAcceptedDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing, invalid or expired bearer token (`unauthorized`), a token not minted for a dispute.markets end user (`invalid_token`), the token of a synthetic account that is no longer a member (`account_revoked`), or a synthetic-account token issued before its sessions were revoked by an archive, a password or credential rotation or `revoke-sessions` (`session_revoked`) or expired by `expire-sessions` or the `session.max_age` flow variant (`session_expired`). Revocation applies from the next request, not when the token expires; sign in again after `session_revoked` / `session_expired`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Delete every synthetic transaction + dispute in this tenant","tags":["Dev — synthetic data"],"x-required-scopes":["dev.reset"]}},"/v1/dev/advance-lifecycle":{"post":{"description":"Runs the hourly lifecycle pass now, in this tenant only (expire past-due RFIs and chargebacks; rule on disputes under review for more than 55 days). Without a body it evaluates every auto-lifecycle dispute of the tenant against the current time, as before. `as_of` evaluates deadlines at a later instant and `issuer_decision` fixes the verdict. With `dispute_ids` or `generate_job_id` only those disputes are evaluated, including pinned (`manual`) ones, so a test advances exactly its own fixtures. Other tenants' disputes are never touched. `scheduled` disputes (a flow profile with `lifecycle.windows` or `lifecycle.review`) are not moved by the pass: with `as_of`, their deadline and ruling jobs due by then are fast-forwarded (at most 500, `count` in the response) and the scheduled-jobs runner applies them within seconds.","operationId":"DevController_advanceLifecycle","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdvanceLifecycleDto"}}}},"responses":{"200":{"description":"How many of this tenant's disputes each phase advanced.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdvanceLifecycleResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`, `invalid_as_of` (before now or more than 400 days ahead), `conflicting_targets` (both `dispute_ids` and `generate_job_id`), `invalid_generate_job_id`, or `too_many_matches` (more than 500 lifecycle jobs due by `as_of`; target fewer disputes). Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`generate_job_id` is not a job of the caller's tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Run the lifecycle pass now in this tenant","tags":["Dev — synthetic data"],"x-idempotent":"replay","x-required-scopes":["dev.advance_lifecycle"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes":{"get":{"description":"Page-based list, newest opened first. `generate_job_id` narrows it to the disputes one dev generate job created, so a test reads only its own fixtures.","operationId":"DisputesController_list","parameters":[{"name":"page_size","required":false,"in":"query","schema":{"example":50,"type":"integer"}},{"name":"category","required":false,"in":"query","schema":{"type":"string"}},{"name":"search","required":false,"in":"query","schema":{"type":"string"}},{"name":"search_on","required":false,"in":"query","schema":{"enum":["any","dispute_id","payment_id","arn","reference","processing_channel"],"type":"string"}},{"name":"unanswered","required":false,"in":"query","schema":{"enum":["1","true"],"type":"string"}},{"name":"from","required":false,"in":"query","schema":{"format":"date-time","type":"string"}},{"name":"to","required":false,"in":"query","schema":{"format":"date-time","type":"string"}},{"name":"generate_job_id","required":false,"in":"query","description":"Only disputes created by this generate job (`gj_…`). A job of another tenant (or none) matches nothing; a malformed id is 400 `invalid_generate_job_id`.","schema":{"example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"view","required":false,"in":"query","description":"`full` (default): every item is a `DisputeDto` with the whole transaction. `summary`: the same dispute fields with the transaction cut to the fields a list shows (`DisputeSummaryPageDto`; about a third of the bytes). Any other value is 400 `validation_failed`.","schema":{"enum":["full","summary"],"type":"string"}},{"name":"status","required":false,"in":"query","schema":{"type":"string"}},{"name":"page","required":false,"in":"query","schema":{"example":1,"type":"integer"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"`DisputePageDto`, or `DisputeSummaryPageDto` with `view=summary`.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/DisputePageDto"},{"$ref":"#/components/schemas/DisputeSummaryPageDto"}]}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"List disputes","tags":["Disputes"],"x-required-scopes":["dispute.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/bulk":{"post":{"description":"Each item is applied in its own unit of work; one result per item, in request order. A failed item does not stop the others.","operationId":"DisputesController_bulk","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkDecisionsDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/BulkResultDto"}}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Apply many decisions at once","tags":["Disputes"],"x-idempotent":"replay","x-required-scopes":["dispute.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/apply-playbook/{playbook_id}":{"post":{"description":"Evaluates the playbook against all `evidence_required` and `rfi_open` disputes of the workspace. `auto_accept` matches are accepted; `auto_defend` and `manual_review` matches get a timeline note.","operationId":"DisputesController_applyPlaybook","parameters":[{"name":"playbook_id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplyPlaybookResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Run a playbook against every open dispute","tags":["Disputes"],"x-idempotent":"replay","x-required-scopes":["dispute.write","playbook.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}":{"get":{"operationId":"DisputesController_findOne","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"The dispute with its transaction and evidence (empty without `evidence.read`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisputeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a dispute","tags":["Disputes"],"x-required-scopes":["dispute.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/events":{"get":{"description":"Oldest first.","operationId":"DisputesController_listEvents","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DisputeEventDto"}}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"List a dispute's timeline events","tags":["Disputes"],"x-required-scopes":["dispute.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/notes":{"post":{"operationId":"DisputesController_addNote","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddNoteDto"}}}},"responses":{"201":{"description":"The `note` event.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisputeEventDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Add a timeline note","tags":["Disputes"],"x-idempotent":"replay","x-required-scopes":["dispute.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/decline-list":{"post":{"operationId":"DisputesController_addToDeclineList","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"201":{"description":"The timeline event recording it.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisputeEventDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Add the cardholder to the decline list","tags":["Disputes"],"x-idempotent":"replay","x-required-scopes":["dispute.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/support-case":{"post":{"operationId":"DisputesController_requestSupport","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveNoteDto"}}}},"responses":{"201":{"description":"The timeline event recording it.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisputeEventDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Open a support case for a dispute","tags":["Disputes"],"x-idempotent":"replay","x-required-scopes":["dispute.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/accept":{"post":{"operationId":"DisputesController_accept","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveNoteDto"}}}},"responses":{"201":{"description":"The dispute after the action.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisputeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. `invalid_dispute_state`: the dispute is not in a state that allows this action (for example already resolved, or no longer awaiting a response); `message` names the current status. Re-read the dispute before retrying. Accept needs `evidence_required` or `under_review`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`action_pending`: an action acknowledged under the `dispute.action_ack` flow variant has not taken effect yet (`details.pending_action`); retry after its `completes_at`. `scheme_unavailable`: a failure simulated by the `dispute.action_failure` flow variant (nothing was written). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Retry-After":{"description":"Seconds to wait before retrying (`service_unavailable`).","schema":{"type":"integer","example":2}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}}},"504":{"description":"`simulated_timeout`: the `dispute.action_failure` flow variant (`timeout_after_commit`) applied the action, then answered as if it timed out. Retry with the same `Idempotency-Key` to get the stored success (`Idempotent-Replayed: true`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Accept a dispute (concede the chargeback)","tags":["Disputes"],"x-idempotent":"replay","x-required-scopes":["dispute.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/challenge":{"post":{"operationId":"DisputesController_challenge","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveNoteDto"}}}},"responses":{"201":{"description":"The dispute after the action.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisputeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"202":{"description":"Only under the `dispute.action_ack` flow variant: the challenge was acknowledged, not applied. `status` is unchanged and `pending_action` says when it takes effect (`completes_at`, job `job_id`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisputeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. `invalid_dispute_state`: the dispute is not in a state that allows this action (for example already resolved, or no longer awaiting a response); `message` names the current status. Re-read the dispute before retrying. Challenge needs `evidence_required`. `evidence_missing`: no evidence file is attached and `available`; attach one with `POST /v1/disputes/{id}/evidence` first. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`action_pending`: an action acknowledged under the `dispute.action_ack` flow variant has not taken effect yet (`details.pending_action`); retry after its `completes_at`. `scheme_unavailable`: a failure simulated by the `dispute.action_failure` flow variant (nothing was written). `too_many_scheduled_jobs`: the workspace already has 200 pending acknowledged actions (100 per correlation prefix); see `Retry-After`. `evidence_processing`: no attached evidence is `available` yet but some is still processing (the `evidence.processing` flow variant); challenge once it is available (`details.processing_count`). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Retry-After":{"description":"Seconds to wait before retrying (`service_unavailable`).","schema":{"type":"integer","example":2}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}}},"504":{"description":"`simulated_timeout`: the `dispute.action_failure` flow variant (`timeout_after_commit`) applied the action, then answered as if it timed out. Retry with the same `Idempotency-Key` to get the stored success (`Idempotent-Replayed: true`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Challenge a dispute with the attached evidence","tags":["Disputes"],"x-idempotent":"replay","x-required-scopes":["dispute.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/rfi-response":{"post":{"operationId":"DisputesController_respondToRfi","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RfiResponseDto"}}}},"responses":{"201":{"description":"The dispute after the action.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisputeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. `invalid_dispute_state`: the dispute is not in a state that allows this action (for example already resolved, or no longer awaiting a response); `message` names the current status. Re-read the dispute before retrying. An RFI response needs `rfi_open`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`action_pending`: an action acknowledged under the `dispute.action_ack` flow variant has not taken effect yet (`details.pending_action`); retry after its `completes_at`. `scheme_unavailable`: a failure simulated by the `dispute.action_failure` flow variant (nothing was written). Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Retry-After":{"description":"Seconds to wait before retrying (`service_unavailable`).","schema":{"type":"integer","example":2}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}}},"504":{"description":"`simulated_timeout`: the `dispute.action_failure` flow variant (`timeout_after_commit`) applied the action, then answered as if it timed out. Retry with the same `Idempotency-Key` to get the stored success (`Idempotent-Replayed: true`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Answer a request for information","tags":["Disputes"],"x-idempotent":"replay","x-required-scopes":["dispute.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/arbitrate":{"post":{"operationId":"DisputesController_escalateToArbitration","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveNoteDto"}}}},"responses":{"201":{"description":"The dispute after the action.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisputeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"202":{"description":"Only under the `dispute.action_ack` flow variant: the escalation was acknowledged, not applied. `status` stays `lost` and `pending_action` says when it takes effect (`completes_at`, job `job_id`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisputeDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. `invalid_dispute_state`: the dispute is not in a state that allows this action (for example already resolved, or no longer awaiting a response); `message` names the current status. Re-read the dispute before retrying. Arbitration needs `lost`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`action_pending`: an action acknowledged under the `dispute.action_ack` flow variant has not taken effect yet (`details.pending_action`); retry after its `completes_at`. `scheme_unavailable`: a failure simulated by the `dispute.action_failure` flow variant (nothing was written). `too_many_scheduled_jobs`: the workspace already has 200 pending acknowledged actions (100 per correlation prefix); see `Retry-After`. Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Retry-After":{"description":"Seconds to wait before retrying (`service_unavailable`).","schema":{"type":"integer","example":2}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}}},"504":{"description":"`simulated_timeout`: the `dispute.action_failure` flow variant (`timeout_after_commit`) applied the action, then answered as if it timed out. Retry with the same `Idempotency-Key` to get the stored success (`Idempotent-Replayed: true`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Escalate a lost dispute to arbitration","tags":["Disputes"],"x-idempotent":"replay","x-required-scopes":["dispute.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/evidence/upload-url":{"post":{"description":"PUT the file to `url` with the same `Content-Type`, then finalize it with `POST /v1/disputes/{id}/evidence`. The URL is never replayed for a repeated `Idempotency-Key`.","operationId":"DisputesController_getEvidenceUploadUrl","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`. This response holds a secret or a signed URL and is never stored: a retry with the same key is 409 `idempotency_secret_not_replayable` with `details.resource_id`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UploadUrlDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EvidenceUploadUrlDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. `invalid_dispute_state`: the dispute is not in a state that allows this action (for example already resolved, or no longer awaiting a response); `message` names the current status. Re-read the dispute before retrying. Evidence can be added while the dispute is `evidence_required` or `under_review`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a presigned URL to upload an evidence file","tags":["Disputes"],"x-idempotent":"no_replay","x-required-scopes":["evidence.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/evidence":{"post":{"description":"Checks the stored file (size and type from storage). A file over 25 MB, or one refused by the `evidence.limits` flow variant, is deleted and the request fails. Under the `evidence.processing` flow variant the file is created `processing` and settled by a scheduled job at `processing_until`.","operationId":"DisputesController_finalizeEvidence","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FinalizeEvidenceDto"}}}},"responses":{"201":{"description":"The attached file: `status` `available`, or `processing` under `evidence.processing`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EvidenceDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. `invalid_dispute_state`: the dispute is not in a state that allows this action (for example already resolved, or no longer awaiting a response); `message` names the current status. Re-read the dispute before retrying. Evidence can be added while the dispute is `evidence_required` or `under_review`. `invalid_storage_key`: `storage_key` is not one this dispute's `upload-url` issued. `evidence_not_uploaded`: nothing was uploaded to `storage_key` yet; PUT the file to the presigned URL first. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`evidence_limit_reached`: the dispute already holds `evidence.limits.max_files_per_dispute` processing or available files (`details.limit`, `details.count`); the uploaded file was deleted. `too_many_scheduled_jobs`: the workspace already has 100 files processing (50 per correlation prefix); see `Retry-After`. Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"413":{"description":"`evidence_too_large`: the stored file is larger than 25 MB (26,214,400 bytes, every workspace) or than `evidence.limits.max_bytes` (`details.max_bytes`, `details.size_bytes`); the file was deleted. `payload_too_large`: the request body itself is too large.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"415":{"description":"`evidence_type_not_allowed`: the stored file's type is not in `evidence.limits.content_types` (`details.content_type`, `details.allowed`); the file was deleted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Attach an uploaded evidence file to a dispute","tags":["Disputes"],"x-idempotent":"replay","x-required-scopes":["evidence.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/disputes/{id}/evidence/{evidence_id}/download-url":{"get":{"operationId":"DisputesController_getEvidenceDownloadUrl","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"evidence_id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedDownloadUrlDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`evidence_not_available`: the file is `processing` or `rejected` (the `evidence.processing` flow variant; `details.status`, `details.rejection_reason`). Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a presigned URL to download an evidence file","tags":["Disputes"],"x-required-scopes":["dispute.read","evidence.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/playbooks":{"get":{"description":"Oldest first, each with its rules.","operationId":"PlaybooksController_list","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/PlaybookDto"}}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"List playbooks","tags":["Playbooks"],"x-required-scopes":["playbook.read"],"x-api-key":true,"x-key-grantable":true},"post":{"operationId":"PlaybooksController_create","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlaybookInputDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlaybookDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Create a playbook","tags":["Playbooks"],"x-idempotent":"replay","x-required-scopes":["playbook.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/playbooks/{id}":{"get":{"operationId":"PlaybooksController_findOne","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlaybookDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a playbook","tags":["Playbooks"],"x-required-scopes":["playbook.read"],"x-api-key":true,"x-key-grantable":true},"patch":{"description":"Replaces the name, flags and the whole rule list.","operationId":"PlaybooksController_update","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlaybookInputDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlaybookDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Replace a playbook","tags":["Playbooks"],"x-idempotent":"replay","x-required-scopes":["playbook.write"],"x-api-key":true,"x-key-grantable":true},"delete":{"operationId":"PlaybooksController_delete","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"204":{"description":"Deleted.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Delete a playbook","tags":["Playbooks"],"x-idempotent":"replay","x-required-scopes":["playbook.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/playbooks/{id}/dry-run":{"post":{"description":"Evaluates every dispute of the workspace against the playbook without changing anything.","operationId":"PlaybooksController_dryRun","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DryRunResultDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Preview what a playbook would do","tags":["Playbooks"],"x-idempotent":"replay","x-required-scopes":["playbook.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/webhooks":{"get":{"description":"Never includes the signing secret. Each webhook carries `accepts_simulation`, its run `filter` and its last 5 deliveries (`recent_deliveries`) with the `webhook.delivery` variant applied to each.","operationId":"WebhooksController_list","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/WebhookDto"}}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"List webhooks","tags":["Webhooks"],"x-required-scopes":["webhook.read"],"x-api-key":true,"x-key-grantable":true},"post":{"description":"Deliveries POST `{event, delivered_at, sequence, data}` (`sequence`: monotonic across the platform, gaps expected; order events by it); `data.actor_sub` is who acted: a user id (the `sub` of their access token) or an API key id (`tak_…`) when a key acted. A webhook created with an API key is tied to it: once the key expires or is revoked, deliveries stop and the webhook is disabled (`webhook.disable`, `reason: key_inactive`). Its `webhook.create` audit event carries `metadata.created_by_api_key: true`.","operationId":"WebhooksController_create","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`. This response holds a secret or a signed URL and is never stored: a retry with the same key is 409 `idempotency_secret_not_replayable` with `details.resource_id`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateWebhookDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebhookWithSecretDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`webhook_url_not_allowed` (URL not https, or its host is or resolves to a private/internal address), or `validation_failed`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Create a webhook; the signing secret is returned once.","tags":["Webhooks"],"x-idempotent":"no_replay","x-required-scopes":["webhook.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/webhooks/{id}":{"patch":{"operationId":"WebhooksController_update","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWebhookDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebhookDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`webhook_url_not_allowed` (URL not https, or its host is or resolves to a private/internal address), or `validation_failed`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Update a webhook URL, events, enabled flag, `accepts_simulation` or run `filter`.","tags":["Webhooks"],"x-idempotent":"replay","x-required-scopes":["webhook.write"],"x-api-key":true,"x-key-grantable":true},"delete":{"operationId":"WebhooksController_delete","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"204":{"description":"Deleted.","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Delete a webhook","tags":["Webhooks"],"x-idempotent":"replay","x-required-scopes":["webhook.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/webhooks/{id}/test":{"post":{"description":"Sends a synthetic `dispute.created` event (`data.test: true`) to exactly this webhook, even when it is disabled, and waits for the answer (10 s budget). `ok` is true when the endpoint answered 2xx; `status_code` is its HTTP status (null when no response arrived). An unknown id is 404 `webhook_not_found` (before 2026-10-29 it answered 200 `{ok: false, message}`). Only this webhook receives the event, never the other subscribers of the workspace. Recorded as `webhook.test` with `webhooks_scheduled: 1` (`failed` when the delivery failed or the id is unknown).","operationId":"WebhooksController_test","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TestWebhookDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TestWebhookResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`webhook_not_found`: this workspace has no webhook with that id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Send a test event to one webhook","tags":["Webhooks"],"x-idempotent":"replay","x-required-scopes":["webhook.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/dev/webhook-sinks":{"post":{"description":"Returns a receiver URL on our own host, valid for 24 h. Point a webhook at it (`POST /v1/webhooks` with `url`; such a webhook is a simulation subscriber unless created with `accepts_simulation: false`) and every delivery it receives is recorded in your audit trail as `webhook_sink.receive` with the delivery id, event, body SHA-256, whether the signature verified (`signature_valid`) and the headers minus the signature, under the triggering request's correlation id. Real receivers must be publicly reachable; this is for tests (CI cannot receive webhooks on localhost). At most 10 live sinks per workspace. Audited as `webhook_sink.create`.","operationId":"WebhookSinksController_create","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateWebhookSinkDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebhookSinkDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`webhook_sink_limit`: the workspace already holds 10 unexpired sinks. Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Create a dev webhook sink for self-contained webhook tests","tags":["Dev — webhook sinks"],"x-idempotent":"replay","x-required-scopes":["dev.generate"],"x-api-key":true,"x-key-grantable":true}},"/v1/dev/webhook-sinks/{id}":{"delete":{"description":"Ends the sink's life now instead of 24 h after creation, which frees one of the 10 live sinks a workspace may hold. Further deliveries to its URL answer 404. Retiring a sink that has already expired is a no-op that still answers 204, so a cleanup retry never fails. Audited as `webhook_sink.delete` (`metadata.was_live`).","operationId":"WebhookSinksController_retire","parameters":[{"name":"id","required":true,"in":"path","description":"The sink id (`whs_…`).","schema":{"type":"string","pattern":"^whs_[0-9A-Z]{24}$"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"204":{"description":"Retired (or already expired).","headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`not_found`: this workspace has no sink with that id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Retire a dev webhook sink now (test cleanup)","tags":["Dev — webhook sinks"],"x-idempotent":"replay","x-required-scopes":["dev.generate"],"x-api-key":true,"x-key-grantable":true}},"/v1/dev/webhook-sinks/{id}/receive":{"post":{"description":"The URL a dev webhook sink hands out. Records `webhook_sink.receive` in the sink owner's audit trail: `metadata.delivery_id`, `event`, `body_sha256`, `signature_valid` (the hex HMAC-SHA256 in `X-Dispute-Signature` checked against the signing secret of the workspace's webhooks whose URL is this sink) and `headers` (minus the signature, credentials and proxy headers). The row carries the correlation id of the request that triggered the delivery when it is a dispute.markets delivery; otherwise a claimed `X-Dispute-Correlation-Id` is kept as `metadata.unverified_correlation_id`. Body at most 64 KB; at most 30 deliveries per sink per minute.","operationId":"WebhookSinkReceiverController_receive","parameters":[{"name":"id","required":true,"in":"path","description":"The sink id (`whs_…`).","schema":{"type":"string","pattern":"^whs_[0-9A-Z]{24}$"}},{"name":"X-Dispute-Correlation-Id","in":"header","description":"Correlation id of the triggering request.","required":false,"schema":{"type":"string"}},{"name":"X-Dispute-Event","in":"header","description":"The event name, e.g. `dispute.created`.","required":false,"schema":{"type":"string"}},{"name":"X-Dispute-Delivery-Id","in":"header","description":"The delivery id (`whd_…`).","required":false,"schema":{"type":"string"}},{"name":"X-Dispute-Signature","in":"header","description":"Hex HMAC-SHA256 of the raw body with the webhook secret.","required":false,"schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}}],"requestBody":{"required":false,"description":"Any payload up to 64 KB (a webhook delivery is JSON).","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SinkReceivedDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"404":{"description":"`not_found`: no such sink, or it expired.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"413":{"description":"`payload_too_large`: the body is over 64 KB.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"429":{"description":"`rate_limited`: over the per-sink limit; see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}}}}},"summary":"Receive a webhook delivery into a dev sink (no auth)","tags":["Dev — webhook sinks"]}},"/v1/transactions":{"get":{"description":"Page-based list, newest first. `generate_job_id` narrows it to the transactions one dev generate job created.","operationId":"TransactionsController_list","parameters":[{"name":"page_size","required":false,"in":"query","schema":{"example":50,"type":"integer"}},{"name":"status","required":false,"in":"query","schema":{"type":"string"}},{"name":"card_brand","required":false,"in":"query","schema":{"type":"string"}},{"name":"search","required":false,"in":"query","schema":{"type":"string"}},{"name":"from","required":false,"in":"query","schema":{"format":"date-time","type":"string"}},{"name":"to","required":false,"in":"query","schema":{"format":"date-time","type":"string"}},{"name":"generate_job_id","required":false,"in":"query","description":"Only transactions created by this generate job (`gj_…`). A job of another tenant (or none) matches nothing; a malformed id is 400 `invalid_generate_job_id`.","schema":{"example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3","type":"string"}},{"name":"page","required":false,"in":"query","schema":{"example":1,"type":"integer"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TransactionPageDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"List transactions","tags":["Transactions"],"x-required-scopes":["transaction.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/transactions/export.csv":{"get":{"description":"The transactions the list shows for the same filters (`status`, `card_brand`, `search`, `from`, `to`), newest first, streamed. At most 100,000 rows: a larger export is refused before the first byte with 413 `export_too_large`; create a report (`POST /v1/reports`) for the full file. Text cells starting with `=`, `+`, `-`, `@`, tab or CR are prefixed with `'` so spreadsheets show them as text (amounts are numbers and never prefixed). The header row is always written, even with no rows. A sensitive read: each export writes a `transaction.export` audit row (`rows`, and `filters` naming the filters given).","operationId":"TransactionsController_exportCsv","parameters":[{"name":"status","required":false,"in":"query","description":"Only this status, as in the list.","schema":{"type":"string"}},{"name":"card_brand","required":false,"in":"query","description":"Only this card brand, as in the list.","schema":{"type":"string"}},{"name":"search","required":false,"in":"query","description":"Same matching as the list: exact id, processor reference or last 4, or part of the merchant name or customer email.","schema":{"type":"string"}},{"name":"from","required":false,"in":"query","description":"Created at or after this instant.","schema":{"format":"date-time","type":"string"}},{"name":"to","required":false,"in":"query","description":"Created at or before this instant.","schema":{"format":"date-time","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"CSV with a header row: `id,createdAt,status,amount,currency,cardBrand,cardLast4,mcc,merchantName,customerEmail,customerName,processorReference`, CRLF line breaks.","content":{"text/csv":{"schema":{"type":"string"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`bad_request`: `from` or `to` is not a date-time. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"text/csv":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"413":{"description":"`export_too_large`: more than 100,000 transactions match; narrow the filters or create a report (`POST /v1/reports`). `details.limit` is the cap. Audited as a failed `transaction.export`.","content":{"text/csv":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Export transactions as CSV","tags":["Transactions"],"x-required-scopes":["transaction.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/transactions/{id}":{"get":{"operationId":"TransactionsController_findOne","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TransactionDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a transaction","tags":["Transactions"],"x-required-scopes":["transaction.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/payments/{id}":{"get":{"operationId":"PaymentsController_detail","parameters":[{"name":"id","required":true,"in":"path","description":"A transaction id (`txn_…`) or a dispute id (`dsp_…`).","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaymentDetailDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a payment: transaction, dispute and event history","tags":["Payments"],"x-required-scopes":["transaction.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/reports":{"get":{"description":"Every live report of the workspace, newest first (deleted reports are not listed). Optional filters: `run_key` (one run's reports), `status` (comma-separated), `ids` (comma-separated `rpt_…`, at most 200; the portal polls `?status=queued,running&ids=…`), `order=created_asc|created_desc` and `limit` (1-200). The response is a plain array.","operationId":"ReportsController_list","parameters":[{"name":"run_key","required":false,"in":"query","description":"Only reports of this run (`run_key`).","schema":{"maxLength":64,"example":"run_8f2","type":"string"}},{"name":"status","required":false,"in":"query","description":"Comma-separated statuses to include (any of).","schema":{"example":"done,failed","type":"string"}},{"name":"ids","required":false,"in":"query","description":"Comma-separated report ids (`rpt_…`, at most 200): only these reports. Combine with `status` to poll the ones still pending (`?status=queued,running&ids=rpt_a,rpt_b`); an id that is unknown, deleted or filtered out is simply absent.","schema":{"example":"rpt_QPTA0YAC7TDT82KPZ9VK4P85,rpt_7Y0B9C1D2E3F4G5H6J7K8M9N0P","type":"string"}},{"name":"order","required":false,"in":"query","description":"Newest first (the default) or oldest first.","schema":{"default":"created_desc","type":"string","enum":["created_desc","created_asc"]}},{"name":"limit","required":false,"in":"query","description":"At most this many reports (default: all).","schema":{"minimum":1,"maximum":200,"type":"integer"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ReportDto"}}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"List reports","tags":["Reports"],"x-required-scopes":["report.read"],"x-api-key":true,"x-key-grantable":true},"post":{"description":"By default builds the CSV during the request and returns the report as `done` (or `failed`, with `error_message` and `error_code`: a report holds at most 100,000 rows; narrow the date range for more). Fetch the file with `GET /v1/reports/{id}/download-url`.\n\nFlow variants (`X-DM-Flow`, stamped on the report): `report.delivery {mode: \"async\", delay_s, build_s}` returns the report `queued` with `ready_at` at once; it turns `running` at `ready_at` (with `progress_pct`) and ends `done` or `failed` after `build_s`, written by a `report.build` scheduled job (fast-forward it with `POST /v1/scheduled-jobs/fast-forward {target_id}`). `report.outcome` simulates failures, retries, empty and truncated files. A signed-in creator of an async report follows it as a background task (`background_task_id`).\n\n`report.limits {max_live}` (set by the workspace owner) limits how many reports one run (`run_key`: the `X-Correlation-Id` prefix before the first `:`) can have at once. At the limit the create is 409 `report_limit_reached`: delete one of `details.oldest` (`DELETE /v1/reports/{id}`), then retry with a new `Idempotency-Key`. Waiting never frees a slot, so there is no `Retry-After`.","operationId":"ReportsController_create","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateReportDto"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatedReportDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`report_limit_reached`: the run already has `report.limits.max_live` live reports (queued, running, done or failed); `details` lists the oldest to delete and the `Link: <…>; rel=\"oldest-deletable\"` header points at the same list. `too_many_scheduled_jobs`: the workspace already has 20 pending async report builds (10 under one correlation prefix); see `Retry-After`. Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ErrorResponseDto"},{"type":"object","properties":{"code":{"type":"string","enum":["report_limit_reached","too_many_scheduled_jobs"]},"details":{"$ref":"#/components/schemas/ReportLimitReachedDetailsDto"}}}]}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Create a CSV report","tags":["Reports"],"x-idempotent":"replay","x-required-scopes":["report.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/reports/{id}/retry":{"post":{"description":"Runs a `failed` report again under the flow it was created with, as attempt `attempt + 1`: synchronously (returned `done` or `failed`), or, for an async report, `queued` again with a fresh `ready_at` and a new `report.build` job. Use it with `report.outcome {mode: \"fail_then_ok\", n}` to test retry handling.","operationId":"ReportsController_retry","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatedReportDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`report_not_failed`: only a `failed` report can be retried. `too_many_scheduled_jobs`: 20 async builds already pending. Also `idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Retry a failed report","tags":["Reports"],"x-idempotent":"replay","x-required-scopes":["report.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/reports/{id}/cancel":{"post":{"description":"Cancels the live `report.build` job of an async report: the report ends `failed` with `error_code: canceled`. A report with no live build (synchronous, or already finished) is returned unchanged.","operationId":"ReportsController_cancel","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReportDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Cancel a queued or running report build","tags":["Reports"],"x-idempotent":"replay","x-required-scopes":["report.write"],"x-api-key":true,"x-key-grantable":true}},"/v1/reports/{id}":{"delete":{"description":"Deletes the report and its CSV; cannot be undone. Any report of the workspace can be deleted (`report.write`).\n\nSafe to retry: a repeat call returns 200 with the same body and `already_deleted: true`, and changes nothing.\n\nSide effects: cancels a queued build (`canceled_job_id`); a build already running finishes without saving. The file is removed in the background (audit `report.purge`, `object_existed`). Afterwards the report is not listed, and `GET /v1/reports/{id}` and its download-url answer 410 `report_deleted`.\n\nRecovery: use after 409 `report_limit_reached`: delete one of `details.oldest`, then retry the create with a new `Idempotency-Key`.","operationId":"ReportsController_remove","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReportTombstoneDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ErrorResponseDto"},{"type":"object","properties":{"code":{"type":"string","enum":["missing_permission","missing_scope"]}}}]}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"`report_not_found`: no such report in this workspace (never existed, another workspace's, or deleted more than 90 days ago).","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ErrorResponseDto"},{"type":"object","properties":{"code":{"type":"string","enum":["report_not_found"]}}}]}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"410":{"description":"`report_deleted` is never returned here (a repeat delete is 200 `already_deleted: true`); listed for clients that share one handler with the read routes.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ErrorResponseDto"},{"type":"object","properties":{"code":{"type":"string","enum":["report_deleted","report_expired"]},"details":{"$ref":"#/components/schemas/ReportDeletedDetailsDto"}}}]}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Delete a report","tags":["Reports"],"x-dm-tool":{"destructiveHint":true,"idempotentHint":true,"readOnlyHint":false},"x-idempotent":"replay","x-required-scopes":["report.write"],"x-api-key":true,"x-key-grantable":true},"get":{"operationId":"ReportsController_findOne","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReportDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"410":{"description":"`report_deleted`: the report was deleted (`details: {id, deleted_at, deleted_by}`). An expired report is still 200 with `status: expired`.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ErrorResponseDto"},{"type":"object","properties":{"code":{"type":"string","enum":["report_deleted","report_expired"]},"details":{"$ref":"#/components/schemas/ReportDeletedDetailsDto"}}}]}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a report","tags":["Reports"],"x-required-scopes":["report.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/reports/{id}/download-url":{"get":{"description":"The link lives 300 s by default; the `report.download_url` flow variant sets `ttl_s` (1 s to 7 days) or `{mode: \"expired\"}` (a link storage refuses at once). 400 while the report is not `done`.","operationId":"ReportsController_downloadUrl","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedDownloadUrlDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"410":{"description":"`report_expired`: the report is older than 90 days and its file was deleted (`details: {created_at}`). `report_deleted`: the report was deleted (`details: {id, deleted_at, deleted_by}`).","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ErrorResponseDto"},{"type":"object","properties":{"code":{"type":"string","enum":["report_deleted","report_expired"]},"details":{"$ref":"#/components/schemas/ReportDeletedDetailsDto"}}}]}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get a presigned URL to download a report CSV","tags":["Reports"],"x-required-scopes":["report.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/metrics/overview":{"get":{"description":"Without `currency`, amounts of every currency are summed as-is (minor units). With `currency`, every figure (counts included) covers only transactions and disputes in that currency. Daily series buckets are calendar days in `tz` (default UTC).","operationId":"MetricsController_overview","parameters":[{"name":"from","required":false,"in":"query","schema":{"format":"date-time","type":"string"}},{"name":"to","required":false,"in":"query","schema":{"format":"date-time","type":"string"}},{"name":"currency","required":false,"in":"query","description":"ISO 4217 code in upper case: only rows in this currency count. Absent = every currency, summed as-is.","schema":{"pattern":"^[A-Z]{3}$","example":"EUR","type":"string"}},{"name":"tz","required":false,"in":"query","description":"IANA time zone the daily series is bucketed in (`series.points[].date` is the local calendar day). Absent = UTC.","schema":{"example":"Europe/Lisbon","type":"string"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MetricsOverviewDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`: `currency` is not an ISO 4217 code or `tz` is not an IANA time zone (`details[].field`). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`. Also simulated by the `api.rate_limit` flow variant: `rate_limited` with `details.simulated: true` and `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Dashboard totals, KPIs and a daily series","tags":["Metrics"],"x-required-scopes":["dispute.read"],"x-api-key":true,"x-key-grantable":true}},"/v1/settings/workspace":{"get":{"description":"Name, company, default currency and time zone, and the environment label. Any member of the workspace (and any of its API keys) can read them. Also in `GET /v1/auth/me` as `workspace_settings`.","operationId":"WorkspaceSettingsController_get","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceSettingsDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Get the workspace settings","tags":["Settings"],"x-api-key":true,"x-key-grantable":true},"patch":{"description":"Send only the fields to change; `null` clears a nullable one. Renames the workspace (`name`, `company`) and sets the tenant-shared defaults: `default_currency` (ISO 4217), `default_time_zone` (IANA), and the environment label and colour. Only the owner's signed-in session can call it. A body that changes nothing returns the settings and writes nothing. Recorded as `workspace_settings.update` with `changes` = `{from, to}` per changed field.","operationId":"WorkspaceSettingsController_update","parameters":[{"name":"Idempotency-Key","in":"header","description":"Optional. Makes a retry safe: send the same value (8-255 characters of `A-Z a-z 0-9 _ -`) when retrying this request and, for 24 hours, it is not executed again. Keys are scoped to the caller (the API key or the signed-in user) in this workspace. A replayed response carries `Idempotent-Replayed: true` and writes no audit event. The same key with a different method, path, query or body is 409 `idempotency_key_reuse`; a retry while the first request is still running is 409 `idempotency_in_progress` (retry after `Retry-After`). A request that failed frees its key. An invalid value is 400 `idempotency_key_invalid`.","required":false,"schema":{"type":"string","minLength":8,"maxLength":255,"pattern":"^[A-Za-z0-9_-]{8,255}$"}},{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}},{"name":"X-DM-Scopes","in":"header","required":false,"description":"API keys only: comma-separated permissions to narrow this request to (intersection with the key's scopes; never widens). An unknown name is 400 `invalid_scopes`. Lets one key test its own denied paths.","schema":{"type":"string","example":"dispute.read,audit.read"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWorkspaceSettingsDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceSettingsDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"Idempotent-Replayed":{"description":"`true` when this is the stored response of an earlier request with the same `Idempotency-Key` (nothing was executed or audited).","schema":{"type":"string","enum":["true"]}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`: an empty body, or a field out of range (`details[].field` names it: unknown time zone or currency, label over 24 characters, colour not `#rrggbb`, empty name). Also `idempotency_key_invalid` (malformed Idempotency-Key). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"Missing or invalid credentials: `unauthorized` / `invalid_token` / `account_revoked` / `session_revoked` / `session_expired` (JWT; `account_revoked` = the synthetic account is no longer a member, `session_revoked` = its sessions were revoked by archive, rotation or revoke-sessions, `session_expired` = expired by expire-sessions or `session.max_age`; sign in again), `invalid_api_key` (unknown, revoked or expired key, or a mistyped one), or `api_key_not_allowed` (a key on an operation that does not take keys).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"`missing_permission` (JWT) or `missing_scope` (API key, including scopes removed by `X-DM-Scopes`); an `outcome=denied` audit event is written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`idempotency_key_reuse` (this Idempotency-Key was used with a different method, path, query or body), `idempotency_in_progress` (the first request with this key is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was too large to replay) or `idempotency_secret_not_replayable` (the original response held a secret or signed URL; `details.resource_id`). No audit event is written for these. Also `workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"`rate_limited` (per-key budget, see `RateLimit-*`) or `too_many_failed_verifications` (too many bad keys from this address); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"`auth_unavailable`: the key could not be verified right now (only for keys not verified in the last 30 s); retry after `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]},{"tenantApiKey":[]}],"summary":"Change the workspace settings","tags":["Settings"],"x-idempotent":"replay","x-required-scopes":["workspace.write"],"x-api-key":true,"x-key-grantable":false}},"/v1/me/preferences":{"get":{"description":"Time zone, language, date format, clock, page size, default disputes tab and theme, with defaults filled in, and `effective_time_zone` (yours, else the workspace zone, else UTC). Also in `GET /v1/auth/me` as `preferences`.","operationId":"MePreferencesController_get","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserPreferencesDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"Bad request: `validation_failed`, `invalid_correlation_id`, `invalid_json` or `bad_request`. Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"`api_key_not_allowed`: preferences belong to a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Get your preferences","tags":["Me — preferences"]},"patch":{"description":"Send only the fields to change; `null` clears a nullable one. Applies to you only, in this workspace. A body that changes nothing writes nothing. Recorded as `user_preferences.update` with `changes` = `{from, to}` per changed field.","operationId":"MePreferencesController_update","parameters":[{"name":"X-Correlation-Id","in":"header","required":false,"description":"Caller-chosen id that tags this request (and, later, its audit events). Echoed on the response.","schema":{"type":"string","maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"}},{"name":"X-DM-Workspace","in":"header","required":false,"description":"The workspace (`tnt_…`) this request is meant for. When it differs from the workspace the session or key acts in, the request is refused with 409 `workspace_mismatch` (`details.current_workspace_id`) and does nothing. Optional; ignored on operations without authentication.","schema":{"type":"string","maxLength":28,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},{"name":"X-DM-Flow","in":"header","required":false,"description":"Run this request under a flow profile of your workspace: `fp_…` (its current version), `fp_…@N` (pinned) or `fp_platform` (today's behaviour). Honoured only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope); for anyone else it is ignored and the response says `X-DM-Flow-Warning: ignored_not_permitted`. When honoured, an unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.","schema":{"type":"string","maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateUserPreferencesDto"}}}},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserPreferencesDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"400":{"description":"`validation_failed`: an empty body, or a value outside its list (`details[].field` names it: unknown time zone, a language the portal does not have, page size not 25/50/100/200). Also `invalid_flow_profile` (`X-DM-Flow` names no usable profile).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"401":{"description":"`api_key_not_allowed`: preferences belong to a signed-in user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"403":{"description":"Authenticated, but not allowed: `missing_permission` (the role lacks a permission the route requires; an `outcome=denied` audit event is written) or `forbidden`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"404":{"description":"Not found, or not visible to this tenant (`not_found`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"409":{"description":"`workspace_mismatch`: `X-DM-Workspace` names another workspace than the one this session or key acts in (`details.current_workspace_id`). `no_active_workspace`: a session token that names no workspace, on an operation that acts in one (switch into a workspace first).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"429":{"description":"Rate limited (`rate_limited`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"500":{"description":"Unexpected server error (`internal_error`). Quote `request_id`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}},"503":{"description":"Temporarily unavailable (`service_unavailable`); see `Retry-After`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseDto"}}},"headers":{"X-Request-Id":{"description":"Id of this request (`req_<ulid>`). Also in every error body as `request_id` and on every audit event the request caused.","schema":{"type":"string","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"}},"X-Correlation-Id":{"description":"Echo of the `X-Correlation-Id` request header, when one was sent.","schema":{"type":"string","example":"checkout-spec-42"}},"X-Audit-Seq":{"description":"Highest audit-event sequence number this request wrote in the tenant's trail (absent when it wrote none). Sequence numbers are per tenant, gapless and in commit order.","schema":{"type":"string","pattern":"^[0-9]+$","example":"1042"}},"X-DM-Flow-Applied":{"description":"The flow profile this request (and any resource it created) used: `fp_…@N`, or `fp_platform` for today's behaviour.","schema":{"type":"string","example":"fp_platform"}},"X-DM-Flow-Warning":{"description":"Comma-separated warnings about the flow profile: `archived` (archived less than 24 hours ago; it stops resolving after that), `ignored_not_permitted` (`X-DM-Flow` was sent by a caller that may not choose a profile), `latency_budget` (`api.latency` was skipped: 10 delayed requests of the workspace already in flight on this server), `rate_limit_needs_correlation` (`api.rate_limit` was skipped: no `X-Correlation-Id`).","schema":{"type":"string","example":"ignored_not_permitted"}}}}},"security":[{"bearer":[]}],"summary":"Change your preferences","tags":["Me — preferences"]}}},"info":{"title":"dispute-api","description":"Backend for dispute.markets: synthetic chargeback workflows and team admin. All endpoints are under /v1.\n\n**Authentication.** `Authorization: Bearer <token>`, where the token is a portal user's access token (a JWT, what the portal sends; security scheme `bearer`) or a tenant API key (`pctk_live_…`, created by the workspace owner; security scheme `tenantApiKey`). A key works only on operations that list `tenantApiKey` and only within its scopes (`x-required-scopes`); anywhere else it gets 401 `api_key_not_allowed`. Send `X-DM-Scopes` to narrow a key for one request (never widens). Keys are limited per key and per replica to 600 requests, 300 writes and 60 `/v1/dev` requests a minute (`RateLimit-*` headers; 429 with `Retry-After`). A revoked key stops working within 30 seconds.\n\n**Request ids.** Every response carries `X-Request-Id` (`req_<ulid>`); error bodies repeat it as `request_id`.\n\n**Correlation.** Send `X-Correlation-Id` (1-128 characters of `A-Z a-z 0-9 . _ : / -`) to tag a request, for example with the name of the e2e test that made it. It is echoed on the response; an invalid value is rejected with 400 `invalid_correlation_id`.\n\n**Retries.** Writes an API key can call accept an optional `Idempotency-Key` (8-255 characters of `A-Z a-z 0-9 _ -`). A retry with the same key, method, path, query and body within 24 hours is not executed again: it gets the original status and body with `Idempotent-Replayed: true`, and writes no audit event. Keys are scoped to the caller in the workspace. Errors: 409 `idempotency_key_reuse` (same key, different request), `idempotency_in_progress` (the first request is still running; see `Retry-After`), `idempotency_response_too_large` (the original response was over 64 KB) and `idempotency_secret_not_replayable` (the response held a secret or signed URL; `details.resource_id` names what was created); 400 `idempotency_key_invalid`. None of them writes an audit event. A request that failed frees its key.\n\n**Flow profiles.** The workspace owner (or an API key the owner minted with `flow.read`) can send `X-DM-Flow: fp_…[@version]` to run a request under a flow profile; `fp_platform` means today's behaviour. Without it, requests resolve to the workspace default (`PUT /v1/flow-profiles/default`), then `fp_platform`; a synthetic account resolves its owner-assigned profile first. Every authenticated response says which profile applied in `X-DM-Flow-Applied: fp_…@N`; `X-DM-Flow-Warning` carries `archived` (the profile was archived less than 24 hours ago) or `ignored_not_permitted` (the caller may not choose a profile, so the header was ignored). An unknown, foreign or long-archived profile is 400 `invalid_flow_profile`.\n\n**Workspaces.** A session token acts in the workspace it was switched into (sign-in lands in the default one: the last switched to, then the oldest joined); a key acts in the workspace it was created in. Send `X-DM-Workspace: tnt_…` to make a request fail instead of acting anywhere else: when it names a different workspace the answer is 409 `workspace_mismatch` with `details.current_workspace_id` (reads too, so nothing is cached across workspaces). The header is optional. A session token that names no workspace (an account that belongs to none yet, or was just removed) is never given one implicitly: it reaches only the account operations (`/auth/me`, `/me/workspaces`, `/me/invites`, `/me/emails`, `POST /workspaces`, `/auth/switch-workspace`, invite accept, `/auth/bootstrap`, e-mail verification and MFA self-service) and gets 409 `no_active_workspace` everywhere else; switch into a workspace first.\n\n**Errors.** Every 4xx/5xx body is `{status_code, message, error, code, request_id, details?}`. Branch on `code` (stable, lowercase snake_case), not on `message`.\n\n**Naming.** Every key on the wire is snake_case: request and response bodies, query parameters, webhook payloads and errors. Requests also accept the camelCase names the API used before (`pageSize`, `cardBrand`, `fromDate`, …); when both are sent, snake_case wins. During a deprecation window, responses and webhook payloads of the resources that used to be camelCase (disputes, transactions, metrics, reports, webhooks, playbooks, synthetic accounts, the dev panel, the error envelope) also carry each such key under its old camelCase name, with the same value, and say so with `Deprecation: true` and `Link: <https://dispute.markets/docs/api/conventions>; rel=\"deprecation\"`. Those aliases are not listed in the schemas; read the snake_case names. Removing them will be announced first. Keys inside data maps (`metadata`, `variants`, `changes`, a flow snapshot) are data and keep their case.\n\n**Webhooks (receiving).** Each delivery is an HTTPS `POST` with a JSON body `{event, delivered_at, sequence, data}` (`WebhookDelivery`; the `x-webhooks` section lists every event and its `data`; during the deprecation window a body also carries the legacy camelCase keys, such as `deliveredAt`, next to their snake_case names) and the headers `User-Agent: dispute.markets-webhooks/1`, `X-Dispute-Event`, `X-Dispute-Delivery-Id` (`whd_…`, the same on every attempt of one delivery), `X-Dispute-Attempt` (1-5), `X-Dispute-Signature` and, when the triggering request had them, `X-Dispute-Request-Id` and `X-Dispute-Correlation-Id`. `X-Dispute-Signature` is the lowercase hex HMAC-SHA256 of the raw body bytes with the webhook's `whsec_…` secret: verify it over the bytes as received, before parsing, with a constant-time comparison. The signature covers the body only (no timestamp): to bound replays, reject a `delivered_at` older than your tolerance (for example 5 minutes, allowing for the retry schedule only if you accept retries late) and de-duplicate on `X-Dispute-Delivery-Id`. Answer 2xx within 10 s; redirects are not followed (a 3xx counts as a failure). No response, 408, 409, 425, 429 and 5xx are retried, up to 5 attempts in all, after 1 min, 5 min, 15 min, 40 min (±20 %); any other status is final. A retry sends byte-identical body bytes (same `delivered_at`, same signature). `sequence` grows with every delivery the platform creates (gaps are normal; it is null only in the rare case the counter could not be read), so a receiver can order events by it. Dispute events come from actions taken through the API or the portal: `dispute.status_changed` (accept, challenge, arbitration, RFI response), `dispute.evidence_added` (evidence attached) and `dispute.note_added` (notes, `decline-list` and `support-case`); `dispute.created` from `POST /v1/webhooks/{id}/test` (`data: {test: true, payload}`). Generated disputes, the lifecycle, finished reports and processed evidence send webhooks only when a flow profile turns them on, and then only to simulation subscribers (`accepts_simulation`); `report.ready` and `evidence.processed` are never sent to other webhooks.","version":"1","contact":{}},"tags":[],"servers":[],"components":{"securitySchemes":{"bearer":{"scheme":"bearer","bearerFormat":"JWT","type":"http","description":"A portal user's access token (a JWT, what the portal sends)."},"tenantApiKey":{"scheme":"bearer","bearerFormat":"pctk","type":"http","description":"A tenant API key: `pctk_live_` (or `pctk_test_`) + 43 + `_` + 6 characters. The last part is a checksum that catches typos; it is not a secret. Accepted only on operations listing this scheme."}},"schemas":{"ValidationDetailDto":{"type":"object","properties":{"field":{"type":"string","description":"Dotted path of the property that failed, e.g. `items.0.amount`.","example":"identifier"},"constraints":{"description":"class-validator constraint names that failed. The submitted value is never echoed.","example":["isNotEmpty"],"type":"array","items":{"type":"string"}}},"required":["field","constraints"]},"ErrorResponseDto":{"type":"object","properties":{"status_code":{"type":"number","description":"HTTP status code.","example":400},"message":{"description":"Human-readable message (a list of messages for validation errors). Do not branch on it; use `code`.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}],"example":"Bad Request"},"error":{"type":"string","description":"HTTP reason phrase.","example":"Bad Request"},"code":{"type":"string","description":"Stable machine-readable code in lowercase snake_case, e.g. `bad_request`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `validation_failed`, `rate_limited`, `invalid_correlation_id`, `invalid_json`, `internal_error`, `service_unavailable`.","example":"validation_failed","pattern":"^[a-z][a-z0-9_]*$"},"request_id":{"type":"string","description":"Id of this request (`req_<ulid>`), also sent as the `X-Request-Id` header. Quote it when reporting a problem.","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD","pattern":"^[A-Za-z0-9_-]{8,64}$"},"details":{"description":"Extra structured information. For `validation_failed`: the failed fields, never their values.","type":"array","items":{"$ref":"#/components/schemas/ValidationDetailDto"}}},"required":["status_code","message","error","code","request_id"]},"AuditActorDto":{"type":"object","properties":{"type":{"type":"string","enum":["user","synthetic_account","api_key","system"],"description":"Who acted."},"id":{"type":"string","nullable":true,"description":"The actor's id: `sa_…` for a synthetic account, the API key id for a key, the end-user id for a user, null for the system.","example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"display":{"type":"string","nullable":true,"description":"Human-readable actor: a synthetic account's username, a key's name, the owner's e-mail. Null for a `user` actor unless the caller holds `audit.read_sensitive`.","example":"agent-1"},"on_behalf_of":{"type":"string","nullable":true,"description":"For an API key, its creator; for the system, the job name (`lifecycle`, `generate`).","example":null}},"required":["type","id","display","on_behalf_of"]},"AuditTargetDto":{"type":"object","properties":{"type":{"type":"string","description":"Resource type, e.g. `dispute`, `webhook`, `synthetic_account`.","example":"dispute"},"id":{"type":"string","nullable":true,"description":"Display id of the resource (`dsp_…`, `wh_…`), never an internal UUID.","example":"dsp_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},"required":["type","id"]},"AuditRequestDto":{"type":"object","properties":{"id":{"type":"string","nullable":true,"description":"The request id (`req_<ulid>`), as in `X-Request-Id`.","example":"req_01JBQ9Z6X6W3N2Q4T8V0M5K7RD"},"correlation_id":{"type":"string","nullable":true,"description":"The `X-Correlation-Id` the caller sent (null on cron rows and unverified callers).","example":"run_8f2:3c1a"},"source":{"type":"string","enum":["portal","api","system"],"description":"Where the action came from."},"ip":{"type":"string","nullable":true,"description":"Client IP. Null unless the caller holds `audit.read_sensitive`.","example":null},"user_agent":{"type":"string","nullable":true,"description":"Client user agent (≤256 chars). Null unless the caller holds `audit.read_sensitive`.","example":null},"method":{"type":"string","nullable":true,"description":"HTTP method.","example":"POST"},"path":{"type":"string","nullable":true,"description":"Route template, never the concrete path or query string.","example":"/v1/disputes/:id/accept"}},"required":["id","correlation_id","source","ip","user_agent","method","path"]},"AuditFlowDto":{"type":"object","properties":{"profile_id":{"type":"string","description":"The flow profile version that changed this action (`fp_…@N`).","pattern":"^fp_[A-Za-z0-9_]+@[1-9][0-9]*$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"},"profile_source":{"type":"string","enum":["header","account","tenant_default"],"nullable":true,"description":"Where that profile came from: the `X-DM-Flow` header, the synthetic account's assigned profile, or the workspace default. For a key read from a resource's snapshot, the source recorded in the snapshot."},"variants":{"type":"object","additionalProperties":true,"nullable":true,"description":"Only the non-default variant keys that changed this action, each with its value and scope: `{\"report.delivery\": {\"value\": {...}, \"source\": \"stamped\"}}` (`request` = read from this request's profile, `stamped` = from the resource's snapshot)."}},"required":["profile_id","profile_source","variants"]},"AuditEventDto":{"type":"object","properties":{"id":{"type":"string","description":"Event id.","pattern":"^aud_[0-9A-Z]{24}$","example":"aud_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"object":{"type":"string","enum":["audit_event"]},"seq":{"type":"integer","format":"int64","description":"Per-tenant sequence number: gapless, strictly increasing, in commit order.","example":1042},"occurred_at":{"type":"string","format":"date-time","description":"When the action happened."},"action":{"type":"string","description":"`<resource>.<verb>` from the catalogue (`GET /v1/audit-events/actions`).","pattern":"^[a-z_]+(\\.[a-z_]+)+$","example":"dispute.accept"},"outcome":{"type":"string","enum":["success","denied","failed"],"description":"The result; the verb never encodes it."},"error_code":{"type":"string","nullable":true,"description":"Stable lowercase error code on `denied` / `failed` rows (e.g. `missing_permission`).","example":null},"actor":{"$ref":"#/components/schemas/AuditActorDto"},"target":{"nullable":true,"type":"object","allOf":[{"$ref":"#/components/schemas/AuditTargetDto"}]},"parent_id":{"type":"string","nullable":true,"pattern":"^aud_[0-9A-Z]{24}$","description":"The parent event (a batch or a cron run) this row belongs to.","example":null},"changes":{"type":"object","additionalProperties":true,"nullable":true,"description":"Declared changed fields, e.g. `{\"status\":{\"from\":\"evidence_required\",\"to\":\"accepted\"}}`."},"metadata":{"type":"object","additionalProperties":true,"nullable":true,"description":"Declared metadata keys of the action. Authentication actions' metadata is stripped unless the caller holds `audit.read_sensitive` (audit-layer keys such as `coalesced_count` stay)."},"request":{"$ref":"#/components/schemas/AuditRequestDto"},"flow":{"nullable":true,"description":"The flow variant that changed this action; null when it ran with today's behaviour (`fp_platform`). Additive (schema_version stays 1).","type":"object","allOf":[{"$ref":"#/components/schemas/AuditFlowDto"}]},"schema_version":{"type":"integer","enum":[1],"description":"Envelope version; bumps only on a breaking change."}},"required":["id","object","seq","occurred_at","action","outcome","error_code","actor","target","parent_id","changes","metadata","request","flow","schema_version"]},"AuditCursorDto":{"type":"object","properties":{"seq":{"type":"integer","format":"int64","description":"The tenant's current high-water sequence number (0 before the first event). Use it as `after_seq`.","example":1042}},"required":["seq"]},"AuditCatalogTriggerDto":{"type":"object","properties":{"type":{"type":"string","enum":["http","cron","job","delivery","guard"]},"route":{"type":"string","nullable":true,"description":"For `http`: `METHOD /v1/route/:param`.","example":"POST /v1/disputes/:id/accept"}},"required":["type","route"]},"AuditCatalogEntryDto":{"type":"object","properties":{"action":{"type":"string","example":"dispute.accept"},"description":{"type":"string"},"target_type":{"type":"string","nullable":true,"example":"dispute"},"trigger":{"type":"array","items":{"$ref":"#/components/schemas/AuditCatalogTriggerDto"}},"changes":{"description":"The only fields `changes` may contain.","type":"array","items":{"type":"string"}},"metadata":{"type":"object","additionalProperties":{"type":"string","enum":["string","number","boolean","string[]"]},"description":"The only metadata keys (with types) the action may emit, besides `common_metadata`."},"async":{"type":"boolean","description":"Written after the response (job, cron, delivery): wait for it rather than read it at once."}},"required":["action","description","target_type","trigger","changes","metadata","async"]},"AuditCatalogDto":{"type":"object","properties":{"schema_version":{"type":"integer","enum":[1]},"common_metadata":{"type":"object","additionalProperties":{"type":"string"},"description":"Metadata keys any action may carry (set by the audit layer)."},"data":{"type":"array","items":{"$ref":"#/components/schemas/AuditCatalogEntryDto"}}},"required":["schema_version","common_metadata","data"]},"CursorPaginationDto":{"type":"object","properties":{"next_cursor":{"type":"string","nullable":true,"description":"Pass as `cursor` (with the same filters and order) for the next page; null on the last page."},"has_more":{"type":"boolean","description":"Whether another page exists."}},"required":["next_cursor","has_more"]},"AuditEventListDto":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/AuditEventDto"}},"pagination":{"$ref":"#/components/schemas/CursorPaginationDto"},"high_water_seq":{"type":"integer","format":"int64","description":"The tenant's highest sequence number in the same snapshot as `data`. Continue with `after_seq=high_water_seq` to see only newer events, without gaps or repeats.","example":1042}},"required":["data","pagination","high_water_seq"]},"AuditWaitResultDto":{"type":"object","properties":{"satisfied":{"type":"boolean","description":"Whether at least `min_count` matching events exist after `after_seq`. False only on timeout."},"data":{"description":"Every matching event up to `high_water_seq`, oldest first (at most 200). On `satisfied: false`, the matches seen so far.","type":"array","items":{"$ref":"#/components/schemas/AuditEventDto"}},"high_water_seq":{"type":"integer","format":"int64","description":"Every event up to this seq was examined and every match up to it is in `data`: wait again with `after_seq=high_water_seq` to see only later events, without gaps or repeats.","example":1047}},"required":["satisfied","data","high_water_seq"]},"ScheduledJobTargetDto":{"type":"object","properties":{"type":{"type":"string","description":"What the job acts on: `generate_job`, `report`, `dispute`, `evidence` or `webhook_delivery`.","example":"generate_job"},"id":{"type":"string","nullable":true,"description":"Display id of the target (`gj_…`, `rpt_…`, `dsp_…`, `evd_…`, `whd_…`).","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2"}},"required":["type","id"]},"ScheduledJobMatchDto":{"type":"object","properties":{"id":{"type":"string","example":"sj_01J9Z3K4M5N6P7Q8R9S0T1V2"},"kind":{"type":"string","enum":["generate.run","generate.trickle_batch","generate.cleanup","dev.reset","report.build","report.purge","evidence.process","dispute.complete_action","dispute.deadline","dispute.rule","dispute.escalate","webhook_delivery.release","flow_profile.release_accounts","synthetic_account.setup_delivery_check","workspace_invite.delivery_check","workspace.purge","system.noop"]},"target":{"nullable":true,"type":"object","allOf":[{"$ref":"#/components/schemas/ScheduledJobTargetDto"}]},"state":{"type":"string","enum":["scheduled","running","succeeded","failed","canceled"],"description":"State after the call: a job that was already running or finished is listed as it is, unmoved."},"run_at":{"type":"string","format":"date-time","description":"When the job is due after the call."}},"required":["id","kind","target","state","run_at"]},"ScheduledJobDto":{"type":"object","properties":{"id":{"type":"string","example":"sj_01J9Z3K4M5N6P7Q8R9S0T1V2","pattern":"^sj_[0-9A-Za-z]{24}$"},"kind":{"type":"string","enum":["generate.run","generate.trickle_batch","generate.cleanup","dev.reset","report.build","report.purge","evidence.process","dispute.complete_action","dispute.deadline","dispute.rule","dispute.escalate","webhook_delivery.release","flow_profile.release_accounts","synthetic_account.setup_delivery_check","workspace_invite.delivery_check","workspace.purge","system.noop"],"example":"generate.run"},"state":{"type":"string","enum":["scheduled","running","succeeded","failed","canceled"],"description":"`scheduled` (waiting for `run_at`), `running`, then `succeeded`, `failed` or `canceled`. A job whose runner was interrupted goes back to `scheduled` by itself."},"lane":{"type":"string","enum":["light","heavy"],"description":"Heavy jobs (report builds, generate) run one at a time per server."},"target":{"nullable":true,"type":"object","allOf":[{"$ref":"#/components/schemas/ScheduledJobTargetDto"}]},"run_at":{"type":"string","format":"date-time","description":"When the job is (or was last) due."},"original_run_at":{"type":"string","format":"date-time","description":"When it was first due, before any fast-forward or retry."},"fast_forwarded_by":{"type":"string","nullable":true,"format":"duration","description":"Total time fast-forwards moved it earlier (ISO 8601), or null.","example":"PT1H"},"started_at":{"type":"string","format":"date-time","nullable":true,"description":"When its current (or last) attempt started."},"lateness_ms":{"type":"integer","nullable":true,"minimum":0,"description":"How late the job started against `run_at` (still waiting: how overdue it is now); null for a job not yet due.","example":420},"attempts":{"type":"integer","minimum":0,"description":"Attempts started so far."},"max_attempts":{"type":"integer","minimum":1,"description":"Attempts before the job fails."},"last_error_code":{"type":"string","nullable":true,"description":"Why the last attempt did not succeed: `job_lease_expired`, `job_timeout`, `handler_failed`, `canceled`, or a kind-specific code."},"flow":{"type":"object","additionalProperties":true,"nullable":true,"description":"The flow settings snapshot the job runs with (flow variants); null for default behaviour."},"correlation_id":{"type":"string","nullable":true,"description":"X-Correlation-Id of the request that scheduled it."},"generate_job_id":{"type":"string","nullable":true,"description":"The generate job (`gj_…`) this job belongs to, if any.","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2"},"created_at":{"type":"string","format":"date-time"},"completed_at":{"type":"string","format":"date-time","nullable":true}},"required":["id","kind","state","lane","target","run_at","original_run_at","fast_forwarded_by","started_at","lateness_ms","attempts","max_attempts","last_error_code","flow","correlation_id","generate_job_id","created_at","completed_at"]},"ScheduledJobsPaginationDto":{"type":"object","properties":{"next_cursor":{"type":"string","nullable":true,"description":"Pass as `cursor` (with the same filters) for the next page; null on the last page."},"has_more":{"type":"boolean","description":"Whether another page exists."}},"required":["next_cursor","has_more"]},"ScheduledJobListDto":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ScheduledJobDto"}},"pagination":{"$ref":"#/components/schemas/ScheduledJobsPaginationDto"}},"required":["data","pagination"]},"FastForwardDto":{"type":"object","properties":{"job_ids":{"minItems":1,"maxItems":200,"description":"Selector: these jobs (`sj_…`, at most 200).","example":["sj_01J9Z3K4M5N6P7Q8R9S0T1V2"],"type":"array","items":{"type":"string"}},"target_id":{"type":"string","description":"Selector: the jobs of one resource, by its display id (`rpt_…`, `dsp_…`, `evd_…`, `whd_…`, `gj_…`).","example":"rpt_01J9Z3K4M5N6P7Q8R9S0T1V2"},"generate_job_id":{"type":"string","description":"Selector: every job of one generate job (`gj_…`). Another workspace's job matches nothing.","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2"},"correlation_id":{"type":"string","description":"Selector: jobs scheduled by requests with this X-Correlation-Id, exact, or a prefix of at least 4 characters followed by one trailing `*` (e.g. `run_8f2:*`). `_` and `%` match themselves.","example":"run_8f2:*"},"kind":{"type":"array","description":"Narrowing: only these kinds.","items":{"type":"string","enum":["generate.run","generate.trickle_batch","generate.cleanup","dev.reset","report.build","report.purge","evidence.process","dispute.complete_action","dispute.deadline","dispute.rule","dispute.escalate","webhook_delivery.release","flow_profile.release_accounts","synthetic_account.setup_delivery_check","workspace_invite.delivery_check","workspace.purge","system.noop"]}},"state":{"type":"string","enum":["scheduled","running","succeeded","failed","canceled"],"description":"Narrowing: only jobs in this state."},"by":{"type":"string","format":"duration","description":"Move each job this much earlier (ISO 8601: weeks, days, hours, minutes, seconds), bounded by its remaining delay. Not together with `to_remaining`. Default: due now.","example":"PT1H"},"to_remaining":{"type":"string","format":"duration","description":"Leave this much on each job's clock (`PT1H`: due in one hour). A job due sooner is not moved.","example":"PT10S"},"wait":{"type":"boolean","description":"Return only when every moved job is terminal, or after 25 s (see `terminal`).","default":false}}},"ScheduledJobBulkResultDto":{"type":"object","properties":{"count":{"type":"integer","minimum":0,"description":"Jobs this call moved (fast-forward) or canceled (cancel). 0 when nothing matched, including another workspace's ids."},"matched":{"description":"Every matching job (at most 500), earliest first.","type":"array","items":{"$ref":"#/components/schemas/ScheduledJobMatchDto"}},"terminal":{"type":"boolean","nullable":true,"description":"With `wait: true`: whether every moved job, and every job they scheduled for the same target meanwhile (for example a report's build phase), reached a terminal state before the wait ended. Null without `wait`."}},"required":["count","matched"]},"CancelScheduledJobsDto":{"type":"object","properties":{"job_ids":{"minItems":1,"maxItems":200,"description":"Selector: these jobs (`sj_…`, at most 200).","example":["sj_01J9Z3K4M5N6P7Q8R9S0T1V2"],"type":"array","items":{"type":"string"}},"target_id":{"type":"string","description":"Selector: the jobs of one resource, by its display id (`rpt_…`, `dsp_…`, `evd_…`, `whd_…`, `gj_…`).","example":"rpt_01J9Z3K4M5N6P7Q8R9S0T1V2"},"generate_job_id":{"type":"string","description":"Selector: every job of one generate job (`gj_…`). Another workspace's job matches nothing.","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2"},"correlation_id":{"type":"string","description":"Selector: jobs scheduled by requests with this X-Correlation-Id, exact, or a prefix of at least 4 characters followed by one trailing `*` (e.g. `run_8f2:*`). `_` and `%` match themselves.","example":"run_8f2:*"},"kind":{"type":"array","description":"Narrowing: only these kinds.","items":{"type":"string","enum":["generate.run","generate.trickle_batch","generate.cleanup","dev.reset","report.build","report.purge","evidence.process","dispute.complete_action","dispute.deadline","dispute.rule","dispute.escalate","webhook_delivery.release","flow_profile.release_accounts","synthetic_account.setup_delivery_check","workspace_invite.delivery_check","workspace.purge","system.noop"]}},"state":{"type":"string","enum":["scheduled","running","succeeded","failed","canceled"],"description":"Narrowing: only jobs in this state."}}},"BackgroundTaskTargetDto":{"type":"object","properties":{"type":{"type":"string","description":"What the task works on: `generate_job`, `scheduled_job` or `scheduled_jobs` (a watch over several).","example":"generate_job"},"id":{"type":"string","nullable":true,"description":"Its display id (`gj_…`, `sj_…`); null for a watch over several jobs.","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},"required":["type","id"]},"BackgroundTaskProgressDto":{"type":"object","properties":{"done":{"type":"integer","minimum":0,"example":1000},"total":{"type":"integer","minimum":0,"example":5000},"unit":{"type":"string","description":"`transactions` for generate, `jobs` for a watch.","example":"transactions"},"pct":{"type":"integer","minimum":0,"maximum":100,"description":"Whole percent, rounded down.","example":20}},"required":["done","total","unit","pct"]},"BackgroundTaskResultDto":{"type":"object","properties":{"href":{"type":"string","nullable":true,"description":"Portal path that shows the outcome (on success), e.g. the disputes a generate job created.","example":"/disputes?generate_job_id=gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"label_key":{"type":"string","nullable":true,"description":"An i18n key for the result label, when the kind sets one."},"counts":{"type":"object","additionalProperties":{"type":"integer"},"nullable":true,"description":"What the task produced, e.g. `{transactions, disputes}` or a watch's `{succeeded, failed, canceled, gone}`.","example":{"transactions":5000,"disputes":1000}}},"required":["href","label_key","counts"]},"BackgroundTaskErrorDto":{"type":"object","properties":{"code":{"type":"string","description":"Stable error code, e.g. `generate_failed`, `job_lease_expired`, `canceled`.","example":"canceled"},"message":{"type":"string","description":"A fixed sentence for the code (never driver text).","example":"The generate job was canceled."}},"required":["code","message"]},"BackgroundTaskDto":{"type":"object","properties":{"id":{"type":"string","pattern":"^bt_[0-9A-Z]{24}$","example":"bt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"kind":{"type":"string","description":"`generate` or `scheduled_jobs.watch` (more kinds later; unknown kinds are not listed).","example":"generate"},"state":{"type":"string","enum":["queued","running","succeeded","failed","canceled"]},"target":{"$ref":"#/components/schemas/BackgroundTaskTargetDto"},"progress":{"nullable":true,"type":"object","allOf":[{"$ref":"#/components/schemas/BackgroundTaskProgressDto"}]},"eta_at":{"type":"string","format":"date-time","nullable":true,"description":"Estimated finish while the task is active; null when unknown (a generate job shows it after its second chunk). Left out when the estimate comes from a flow delay and the caller lacks `flow.read`."},"started_at":{"type":"string","format":"date-time"},"finished_at":{"type":"string","format":"date-time","nullable":true},"result":{"nullable":true,"type":"object","allOf":[{"$ref":"#/components/schemas/BackgroundTaskResultDto"}]},"error":{"nullable":true,"type":"object","allOf":[{"$ref":"#/components/schemas/BackgroundTaskErrorDto"}]},"cancel_href":{"type":"string","nullable":true,"description":"API path that cancels the task (POST), while it is active and the caller may cancel it; else null.","example":"/v1/dev/generate-jobs/gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3/cancel"},"details":{"type":"object","additionalProperties":{"type":"string","nullable":true},"nullable":true,"description":"Kind-specific display fields for the task title; null when the kind has none. `report.build`: `report_kind` (`disputes` | `transactions`), `from_date` and `to_date` (ISO 8601 date-time or null for an open end) of the report range.","example":{"report_kind":"disputes","from_date":"2026-10-01T00:00:00.000Z","to_date":"2026-10-31T23:59:59.999Z"}}},"required":["id","kind","state","target","progress","started_at","finished_at","result","error","cancel_href","details"]},"BackgroundTaskFeedDto":{"type":"object","properties":{"data":{"description":"Active tasks first, then the newest.","type":"array","items":{"$ref":"#/components/schemas/BackgroundTaskDto"}},"rev":{"type":"string","description":"The feed's revision (it grows on every change to any of your tasks); part of the `ETag`.","pattern":"^[0-9]+$","example":"1042"},"poll_after_ms":{"type":"integer","enum":[2000,30000],"description":"Poll again after this many milliseconds: 2000 while a task is active, else 30000.","example":2000}},"required":["data","rev","poll_after_ms"]},"DismissFinishedDto":{"type":"object","properties":{"dismissed":{"type":"integer","minimum":0,"description":"How many finished tasks were dismissed.","example":3}},"required":["dismissed"]},"ScheduledJobSelectorDto":{"type":"object","properties":{"job_ids":{"minItems":1,"maxItems":200,"description":"Selector: these jobs (`sj_…`, at most 200).","example":["sj_01J9Z3K4M5N6P7Q8R9S0T1V2"],"type":"array","items":{"type":"string"}},"target_id":{"type":"string","description":"Selector: the jobs of one resource, by its display id (`rpt_…`, `dsp_…`, `evd_…`, `whd_…`, `gj_…`).","example":"rpt_01J9Z3K4M5N6P7Q8R9S0T1V2"},"generate_job_id":{"type":"string","description":"Selector: every job of one generate job (`gj_…`). Another workspace's job matches nothing.","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2"},"correlation_id":{"type":"string","description":"Selector: jobs scheduled by requests with this X-Correlation-Id, exact, or a prefix of at least 4 characters followed by one trailing `*` (e.g. `run_8f2:*`). `_` and `%` match themselves.","example":"run_8f2:*"},"kind":{"type":"array","description":"Narrowing: only these kinds.","items":{"type":"string","enum":["generate.run","generate.trickle_batch","generate.cleanup","dev.reset","report.build","report.purge","evidence.process","dispute.complete_action","dispute.deadline","dispute.rule","dispute.escalate","webhook_delivery.release","flow_profile.release_accounts","synthetic_account.setup_delivery_check","workspace_invite.delivery_check","workspace.purge","system.noop"]}},"state":{"type":"string","enum":["scheduled","running","succeeded","failed","canceled"],"description":"Narrowing: only jobs in this state."}}},"WatchScheduledJobsDto":{"type":"object","properties":{"selector":{"description":"Which scheduled jobs to follow: exactly one of `job_ids`, `target_id`, `generate_job_id` or `correlation_id`, optionally narrowed by `kind` and `state` (the fast-forward selectors). At most 500 may match.","allOf":[{"$ref":"#/components/schemas/ScheduledJobSelectorDto"}]}},"required":["selector"]},"DismissedTaskDto":{"type":"object","properties":{"id":{"type":"string","pattern":"^bt_[0-9A-Z]{24}$","example":"bt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"dismissed_at":{"type":"string","format":"date-time"}},"required":["id","dismissed_at"]},"FlowCatalogueEmitsDto":{"type":"object","properties":{"error_codes":{"description":"Error codes a non-default value can make the operation return.","type":"array","items":{"type":"string"}},"audit_actions":{"description":"Audit actions it can add.","type":"array","items":{"type":"string"}},"webhook_events":{"description":"Webhook events it can send (to simulation subscribers only).","type":"array","items":{"type":"string"}}},"required":["error_codes","audit_actions","webhook_events"]},"FlowCatalogueEntryDto":{"type":"object","properties":{"key":{"type":"string","example":"report.delivery"},"operation":{"type":"string","example":"POST /v1/reports"},"schema":{"type":"object","additionalProperties":true,"description":"JSON Schema of the value, with its bounds."},"default":{"type":"object","description":"The platform default (today's behaviour): what `fp_platform` and an unset key mean.","nullable":true},"scope":{"type":"string","enum":["request","stamped"],"description":"`request`: read from each request's profile. `stamped`: resolved once when a resource is created, written to its `flow` snapshot and read only from there afterwards."},"description":{"type":"string"},"emits":{"$ref":"#/components/schemas/FlowCatalogueEmitsDto"}},"required":["key","operation","schema","default","scope","description","emits"]},"FlowCatalogueDto":{"type":"object","properties":{"schema_version":{"type":"integer","enum":[1]},"data":{"type":"array","items":{"$ref":"#/components/schemas/FlowCatalogueEntryDto"}}},"required":["schema_version","data"]},"FlowLimitUsageDto":{"type":"object","properties":{"tenant":{"type":"integer","nullable":true,"description":"Current usage in the workspace (null where it is not counted)."},"correlation_prefix":{"type":"integer","nullable":true,"description":"Usage of the caller's correlation prefix (the part of `X-Correlation-Id` before the first `:`); null without one."}},"required":["tenant","correlation_prefix"]},"FlowLimitDto":{"type":"object","properties":{"key":{"type":"string","example":"pending_report_builds"},"description":{"type":"string"},"per":{"type":"string","enum":["tenant","profile","pod","dispute","value","run"],"description":"What the cap counts per (`value`: a bound on a variant value; `run`: the caller's run, the `X-Correlation-Id` prefix, for `reports_live`)."},"min":{"type":"integer","nullable":true,"description":"Lower bound (value ranges only)."},"max":{"type":"integer"},"unit":{"type":"string","example":"jobs"},"prefix_max":{"type":"integer","nullable":true,"description":"The share one correlation prefix may hold (half of `max`), for job caps."},"usage":{"$ref":"#/components/schemas/FlowLimitUsageDto"},"error_code":{"type":"string","description":"What hitting the cap returns.","example":"too_many_scheduled_jobs"},"limit":{"type":"integer","description":"`reports_live` only (listed when the caller's profile sets `report.limits`): `max_live`.","example":3},"live_count":{"type":"integer","description":"`reports_live` only: live reports of the run now.","example":2},"run_key":{"type":"string","description":"`reports_live` only: the run counted (`default` without an `X-Correlation-Id`).","example":"run_8f2"}},"required":["key","description","per","min","max","unit","prefix_max","usage","error_code"]},"FlowLimitsDto":{"type":"object","properties":{"correlation_prefix":{"type":"string","nullable":true,"description":"The caller's correlation prefix the `correlation_prefix` usage counts."},"data":{"type":"array","items":{"$ref":"#/components/schemas/FlowLimitDto"}}},"required":["correlation_prefix","data"]},"FlowProfileUsedByDto":{"type":"object","properties":{"synthetic_accounts":{"type":"integer","description":"Live synthetic accounts assigned this profile (any version)."},"workspace_default":{"type":"boolean","description":"Whether this profile is the workspace default."}},"required":["synthetic_accounts","workspace_default"]},"FlowProfileDto":{"type":"object","properties":{"id":{"type":"string","pattern":"^fp_[0-9A-Z]{24}$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"object":{"type":"string","enum":["flow_profile"]},"name":{"type":"string","pattern":"^[a-z0-9-]{1,64}$","example":"report-3h-1a2b3c4d"},"description":{"type":"string","nullable":true},"current_version":{"type":"integer","minimum":1,"example":2},"ref":{"type":"string","description":"Pinned reference to the current version (`fp_…@N`), immune to later edits: what tests send in `X-DM-Flow`.","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"},"variants":{"type":"object","additionalProperties":true,"description":"The current version's variants."},"body_hash":{"type":"string","description":"`sha256:` of the canonical JSON of the version body (description and variants).","example":"sha256:9f2c…"},"created_by":{"type":"string","nullable":true,"description":"Who created it: an end-user id or an API key id (`tak_…`)."},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"archived_at":{"type":"string","format":"date-time","nullable":true,"description":"When it was archived. An archived profile resolves through `X-DM-Flow` (and for assigned synthetic accounts) for 24 hours, with `X-DM-Flow-Warning: archived`."},"last_used_at":{"type":"string","format":"date-time","nullable":true,"description":"Last request that resolved it (updated at most hourly). Profiles unused for 30 days are archived."},"used_by":{"$ref":"#/components/schemas/FlowProfileUsedByDto"}},"required":["id","object","name","description","current_version","ref","variants","body_hash","created_by","created_at","updated_at","archived_at","last_used_at","used_by"]},"FlowProfileListDto":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/FlowProfileDto"}},"pagination":{"$ref":"#/components/schemas/CursorPaginationDto"}},"required":["data","pagination"]},"CreateFlowProfileDto":{"type":"object","properties":{"name":{"type":"string","description":"Unique among the workspace's live profiles: `[a-z0-9-]{1,64}`. The example fixture uses `<name>-<hash8>` so different bodies never share a name.","pattern":"^[a-z0-9-]{1,64}$","example":"report-3h-1a2b3c4d"},"description":{"type":"string","nullable":true,"maxLength":500},"variants":{"type":"object","additionalProperties":true,"default":{},"description":"Variant keys from `GET /v1/flows/catalogue`, each within its schema. Keys the profile does not set take the platform default (today's behaviour); profiles are never layered. Unknown keys or out-of-range values are 400 `invalid_flow_variant` (`details: [{field, constraints}]`); over 16 KB is 409 `flow_profile_limit`.","example":{}}},"required":["name"]},"SetFlowDefaultDto":{"type":"object","properties":{"profile_id":{"type":"string","nullable":true,"maxLength":72,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","description":"The profile to make the workspace default: `fp_…` pins its current version, `fp_…@N` pins version N. `null` or `fp_platform` clears the default (today's behaviour). Must be a live profile of this workspace (else 400 `invalid_flow_profile`).","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},"required":["profile_id"]},"FlowDefaultDto":{"type":"object","properties":{"object":{"type":"string","enum":["flow_default"]},"ref":{"type":"string","description":"The workspace default as a pinned reference (`fp_…@N`), or `fp_platform` when there is none.","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"},"profile_id":{"type":"string","nullable":true,"pattern":"^fp_[0-9A-Z]{24}$"},"version":{"type":"integer","nullable":true}},"required":["object","ref","profile_id","version"]},"UpdateFlowProfileDto":{"type":"object","properties":{"description":{"type":"string","nullable":true,"maxLength":500,"description":"New description (part of the version body). Omit to keep it."},"variants":{"type":"object","additionalProperties":true,"description":"The complete variants of the new version (not a merge). Omit to keep them. Variant keys from `GET /v1/flows/catalogue`, each within its schema. Keys the profile does not set take the platform default (today's behaviour); profiles are never layered. Unknown keys or out-of-range values are 400 `invalid_flow_variant` (`details: [{field, constraints}]`); over 16 KB is 409 `flow_profile_limit`."}}},"FlowProfileVersionDto":{"type":"object","properties":{"object":{"type":"string","enum":["flow_profile_version"]},"profile_id":{"type":"string","pattern":"^fp_[0-9A-Z]{24}$","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"version":{"type":"integer","minimum":1},"ref":{"type":"string","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@1"},"description":{"type":"string","nullable":true},"variants":{"type":"object","additionalProperties":true},"body_hash":{"type":"string","example":"sha256:9f2c…"},"created_by":{"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"}},"required":["object","profile_id","version","ref","description","variants","body_hash","created_by","created_at"]},"FlowProfileVersionListDto":{"type":"object","properties":{"data":{"description":"Newest first; at most 50.","type":"array","items":{"$ref":"#/components/schemas/FlowProfileVersionDto"}},"pagination":{"$ref":"#/components/schemas/CursorPaginationDto"}},"required":["data","pagination"]},"ApiKeyDto":{"type":"object","properties":{"id":{"type":"string","description":"Key id.","example":"tak_3a9f2b1c0d4e","pattern":"^tak_[0-9A-Za-z]{4,64}$"},"name":{"type":"string","example":"ci-e2e"},"prefix":{"type":"string","description":"First characters of the secret, to recognise it.","example":"pctk_live_8fK2aB"},"last4":{"type":"string","description":"Last 4 characters of the secret.","example":"x9Qa"},"scopes":{"example":["dispute.read","audit.read"],"type":"array","items":{"type":"string"}},"status":{"type":"string","enum":["active","expired","revoked"]},"created_by":{"type":"string","description":"User id (the `sub` of their access token) of whoever created (or last rotated) the key."},"created_at":{"type":"string","format":"date-time"},"expires_at":{"type":"string","format":"date-time"},"last_used_at":{"type":"string","format":"date-time","nullable":true},"revoked_at":{"type":"string","format":"date-time","nullable":true},"revoke_reason":{"type":"string","enum":["manual","rotated","member_removed","tenant_deleted"],"nullable":true},"rotated_from":{"type":"string","description":"Id (`tak_…`) of the key this one replaced by rotation; null when none, or when that key is not on the same page.","nullable":true,"example":"tak_3a9f2b1c0d4e"},"creator_status":{"type":"string","enum":["active","removed"],"description":"Whether `created_by` is still a member of this workspace. `removed`: the creator (or last rotator) left or was removed, so the key is refused with 401 `invalid_api_key` whatever its `status`, its `api_key.deactivate` trail row carries `reason: member_removed`, and the webhooks and playbooks it created are disabled. Rotate the key to vouch for it again, or revoke it.","example":"active"}},"required":["id","name","prefix","last4","scopes","status","created_by","created_at","expires_at","last_used_at","revoked_at","revoke_reason","rotated_from","creator_status"]},"PaginationDto":{"type":"object","properties":{"next_cursor":{"type":"string","nullable":true},"has_more":{"type":"boolean"}},"required":["next_cursor","has_more"]},"ApiKeyPageDto":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ApiKeyDto"}},"pagination":{"$ref":"#/components/schemas/PaginationDto"}},"required":["data","pagination"]},"ApiKeyScopeOptionDto":{"type":"object","properties":{"name":{"type":"string","description":"Permission string a key may carry.","enum":["transaction.read","dispute.read","dispute.write","evidence.read","evidence.write","report.read","report.write","playbook.read","playbook.write","webhook.read","webhook.write","dev.generate","dev.advance_lifecycle","audit.read","flow.read","flow.write"],"example":"dispute.read"},"description":{"type":"string","description":"One line saying what the scope allows.","example":"Read disputes and their timelines"}},"required":["name","description"]},"ApiKeyOptionsDto":{"type":"object","properties":{"scopes":{"description":"Every scope a key may carry (`KEY_GRANTABLE`). Team, key-management, `dev.access`, `dev.reset` and sensitive-audit scopes are never offered.","type":"array","items":{"$ref":"#/components/schemas/ApiKeyScopeOptionDto"}},"e2e_preset":{"type":"array","description":"The \"E2E testing\" preset: every grantable scope, the same list the example suite uses.","example":["transaction.read","dispute.read","dispute.write"],"items":{"type":"string","enum":["transaction.read","dispute.read","dispute.write","evidence.read","evidence.write","report.read","report.write","playbook.read","playbook.write","webhook.read","webhook.write","dev.generate","dev.advance_lifecycle","audit.read","flow.read","flow.write"]}},"expiry_days":{"type":"array","example":[7,30,90,365],"items":{"type":"number","enum":[7,30,90,365]}},"default_expiry_days":{"type":"number","example":90},"max_grace_hours":{"type":"number","description":"Longest grace period a rotation may give the old key, in hours.","example":24}},"required":["scopes","e2e_preset","expiry_days","default_expiry_days","max_grace_hours"]},"CreateApiKeyDto":{"type":"object","properties":{"name":{"type":"string","description":"What the key is for, shown in lists.","example":"ci-e2e","minLength":1,"maxLength":100},"scopes":{"type":"array","description":"Permissions the key carries, a subset of the grantable ones. A key never does more than its creator's role allows (checked on every request). The portal's \"E2E testing\" preset is all of them.","example":["dispute.read","dispute.write","audit.read"],"items":{"type":"string","enum":["transaction.read","dispute.read","dispute.write","evidence.read","evidence.write","report.read","report.write","playbook.read","playbook.write","webhook.read","webhook.write","dev.generate","dev.advance_lifecycle","audit.read","flow.read","flow.write"]}},"expires_in_days":{"type":"number","description":"Days until the key expires (default 90). Keys always expire.","enum":[7,30,90,365],"default":90}},"required":["name","scopes"]},"ApiKeyWithSecretDto":{"type":"object","properties":{"id":{"type":"string","description":"Key id.","example":"tak_3a9f2b1c0d4e","pattern":"^tak_[0-9A-Za-z]{4,64}$"},"name":{"type":"string","example":"ci-e2e"},"prefix":{"type":"string","description":"First characters of the secret, to recognise it.","example":"pctk_live_8fK2aB"},"last4":{"type":"string","description":"Last 4 characters of the secret.","example":"x9Qa"},"scopes":{"example":["dispute.read","audit.read"],"type":"array","items":{"type":"string"}},"status":{"type":"string","enum":["active","expired","revoked"]},"created_by":{"type":"string","description":"User id (the `sub` of their access token) of whoever created (or last rotated) the key."},"created_at":{"type":"string","format":"date-time"},"expires_at":{"type":"string","format":"date-time"},"last_used_at":{"type":"string","format":"date-time","nullable":true},"revoked_at":{"type":"string","format":"date-time","nullable":true},"revoke_reason":{"type":"string","enum":["manual","rotated","member_removed","tenant_deleted"],"nullable":true},"rotated_from":{"type":"string","description":"Id (`tak_…`) of the key this one replaced by rotation; null when none, or when that key is not on the same page.","nullable":true,"example":"tak_3a9f2b1c0d4e"},"creator_status":{"type":"string","enum":["active","removed"],"description":"Whether `created_by` is still a member of this workspace. `removed`: the creator (or last rotator) left or was removed, so the key is refused with 401 `invalid_api_key` whatever its `status`, its `api_key.deactivate` trail row carries `reason: member_removed`, and the webhooks and playbooks it created are disabled. Rotate the key to vouch for it again, or revoke it.","example":"active"},"key":{"type":"string","description":"The secret. Shown exactly once: store it now. Send it as `Authorization: Bearer <key>`.","example":"pctk_live_8fK2aB…","pattern":"^pctk_(live|test)_[0-9A-Za-z]{43}_[0-9A-Za-z]{6}$"}},"required":["id","name","prefix","last4","scopes","status","created_by","created_at","expires_at","last_used_at","revoked_at","revoke_reason","rotated_from","creator_status","key"]},"RotateApiKeyDto":{"type":"object","properties":{"grace_hours":{"type":"number","description":"Hours the OLD key keeps working (0-24, default 0 = it stops now). Rotation is not for a leaked key: revoke that one instead.","minimum":0,"maximum":24,"default":0},"expires_in_days":{"type":"number","description":"Expiry of the NEW key in days (default: the configured default).","enum":[7,30,90,365]}}},"WhoamiTenantDto":{"type":"object","properties":{"id":{"type":"string","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"name":{"type":"string","example":"Acme sandbox"}},"required":["id","name"]},"WhoamiActorDto":{"type":"object","properties":{"type":{"type":"string","enum":["user","synthetic_account","api_key"]},"id":{"type":"string","description":"The id audit events carry for this actor (`tak_…` for a key, `sa_…` for a synthetic account)."},"display":{"type":"string","nullable":true,"description":"Key name, account label or username."}},"required":["type","id","display"]},"WhoamiWorkspaceDto":{"type":"object","properties":{"id":{"type":"string","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","description":"The workspace this credential acts in (what `X-DM-Workspace` must name)."},"name":{"type":"string","example":"Acme sandbox"},"environment_label":{"type":"string","nullable":true,"maxLength":24,"example":"Staging","description":"The workspace environment label; null = none. Cosmetic: nothing depends on it."},"environment_color":{"type":"string","nullable":true,"pattern":"^#[0-9a-f]{6}$","example":"#d97706","description":"Accent colour of the environment label; null = the default."}},"required":["id","name","environment_label","environment_color"]},"WhoamiKeyDto":{"type":"object","properties":{"id":{"type":"string","example":"tak_3a9f2b1c0d4e"},"name":{"type":"string","example":"ci-e2e"},"prefix":{"type":"string","example":"pctk_live_8fK2aB"},"expires_at":{"type":"string","format":"date-time"}},"required":["id","name","prefix","expires_at"]},"PrincipalFlowDto":{"type":"object","properties":{"default_profile_id":{"type":"string","description":"The workspace default (`fp_…@N`, or `fp_platform`).","example":"fp_platform"},"request_profile_id":{"type":"string","description":"The profile this request resolved to (`X-DM-Flow`, else the default), as `X-DM-Flow-Applied` says.","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"},"request_profile_source":{"type":"string","enum":["header","account","tenant_default","platform"],"description":"Where `request_profile_id` came from."}},"required":["default_profile_id","request_profile_id","request_profile_source"]},"WhoamiDto":{"type":"object","properties":{"tenant":{"$ref":"#/components/schemas/WhoamiTenantDto"},"actor":{"$ref":"#/components/schemas/WhoamiActorDto"},"workspace":{"description":"The workspace this credential acts in, with its environment label.","allOf":[{"$ref":"#/components/schemas/WhoamiWorkspaceDto"}]},"is_human":{"type":"boolean","description":"A person (a workspace member), as opposed to a synthetic account or an API key."},"permissions":{"description":"What this request may do (for a key: its scopes within its creator's role, narrowed by `X-DM-Scopes`).","type":"array","items":{"type":"string"}},"key":{"description":"Present when the caller is an API key.","allOf":[{"$ref":"#/components/schemas/WhoamiKeyDto"}]},"flow":{"description":"Present only for callers holding `flow.read` (the owner, or a key the owner minted with a flow scope).","allOf":[{"$ref":"#/components/schemas/PrincipalFlowDto"}]}},"required":["tenant","actor","workspace","is_human","permissions"]},"SyntheticAccountFlowProfileDto":{"type":"object","properties":{"ref":{"type":"string","description":"What was assigned: `fp_platform`, `fp_…` (current version at request time) or `fp_…@N`.","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3@2"},"profile_id":{"type":"string","description":"The profile id, or `fp_platform`.","example":"fp_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"name":{"type":"string","description":"The profile's name (`platform` for `fp_platform`)."},"version":{"type":"integer","nullable":true,"description":"The pinned version; null = the current version at request time."},"archived_at":{"type":"string","format":"date-time","nullable":true,"description":"Set when the profile was archived: the account keeps it for 24 hours, then uses the workspace default."}},"required":["ref","profile_id","name","version","archived_at"]},"SetupStateDto":{"type":"object","properties":{"status":{"type":"string","enum":["pending","expired","send_failed","bounced","completed"],"description":"`pending`: a link was sent and is unused. `expired`: it ran out (or was cancelled) unused; send a new one. `send_failed`: the mail could not be sent; try again. `bounced`: mail to this address bounced or the address is suppressed; change the email. `completed`: someone used the link and set the password."},"sent_to":{"type":"string","description":"The address the link goes to: the account's sign-in address."},"lands_in":{"type":"string","nullable":true,"description":"The inbox mail to `sent_to` lands in: the address with its `agent-…` tag removed."},"sent_at":{"type":"string","format":"date-time","nullable":true},"expires_at":{"type":"string","format":"date-time","nullable":true},"completed_at":{"type":"string","format":"date-time","nullable":true},"bounced_at":{"type":"string","format":"date-time","nullable":true},"send_count_24h":{"type":"number","description":"Setup emails sent for this account in the last 24 hours (at most 5)."},"next_send_allowed_at":{"type":"string","format":"date-time","nullable":true,"description":"When another link may be sent (a 60 s cooldown, then 5 per 24 hours); null: now."}},"required":["status","sent_to","lands_in","sent_at","expires_at","completed_at","bounced_at","send_count_24h","next_send_allowed_at"]},"SyntheticAccountDto":{"type":"object","properties":{"id":{"type":"string","example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"label":{"type":"string"},"email":{"type":"string"},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only"]},"created_by_end_user_sub":{"type":"string"},"password_rotated_at":{"format":"date-time","type":"string"},"last_seen_at":{"type":"string","format":"date-time","nullable":true},"notes":{"type":"string","nullable":true},"archived_at":{"type":"string","format":"date-time","nullable":true},"created_at":{"format":"date-time","type":"string"},"updated_at":{"format":"date-time","type":"string"},"flow_profile":{"nullable":true,"description":"The flow profile requests as this account resolve to; null = the workspace default. Present only for callers holding `flow.read` (the owner); omitted otherwise.","type":"object","allOf":[{"$ref":"#/components/schemas/SyntheticAccountFlowProfileDto"}]},"credential_mode":{"type":"string","enum":["generated","email"],"description":"`generated`: the password was shown to the owner. `email`: it is set through a setup link mailed to the account's address."},"setup":{"nullable":true,"description":"The setup link's state; null for `generated` accounts.","type":"object","allOf":[{"$ref":"#/components/schemas/SetupStateDto"}]},"mail_to_you":{"type":"boolean","description":"Whether this account's mail (setup links, password resets, e-mailed codes) goes to you, the caller (docs/15 §5.5). Otherwise an owner can take it over with `POST /v1/team/synthetic-accounts/{id}/move-mail`."}},"required":["id","label","email","role","created_by_end_user_sub","password_rotated_at","last_seen_at","notes","archived_at","created_at","updated_at","credential_mode","setup","mail_to_you"]},"SyntheticAccountListDto":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/SyntheticAccountDto"}}},"required":["items"]},"CreateSyntheticAccountDto":{"type":"object","properties":{"label":{"type":"string","minLength":1,"maxLength":120,"example":"Reconciliation bot","description":"One line (no line breaks)."},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only"]},"notes":{"type":"string","maxLength":2000},"mfa_enabled":{"type":"boolean","description":"When true, provision an MFA factor + recovery codes at creation time. See `mfa_method` for which kind."},"mfa_method":{"type":"string","enum":["totp","email"],"description":"MFA factor type when `mfa_enabled` is true. `totp` (default) returns an otpauth URI + secret for whatever operates the bot. `email` skips the authenticator: a single-use code is emailed at each sign-in to the bot's mailbox — requires `email` (a base address), since the default @agents.dispute.markets address cannot receive mail."},"email":{"type":"string","description":"Base mailbox to derive the synthetic address from via plus addressing: `you@example.com` becomes `you+agent-<rand>@example.com`, so mail the account receives lands in an inbox you control. A base that already has a tag is folded into one: `you+qa@example.com` becomes `you+qa-agent-<rand>@example.com`. Must be a **verified** email on your account (`GET /me/emails`; add + verify via `POST /me/emails`), else 400 `email_not_verified`. The tagged local part must fit 64 characters (400 `email_too_long`); quoted or non-ASCII local parts and dispute.markets domains are 400 `email_invalid`. Required with `credential_mode: \"email\"`. Omit to mint an address on `agents.dispute.markets`.","example":"ops@example.com","maxLength":254},"flow_profile":{"type":"string","nullable":true,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","maxLength":72,"description":"The flow profile requests authenticated as this account resolve to (owner only: sending this field, any value including `null`, needs `flow.write` on top of `team.write`, else 403 `missing_permission` and nothing is written). `null` = the workspace default; `fp_platform` = always today's behaviour (shields the account from the workspace default); `fp_…` = that profile's current version at request time; `fp_…@N` = pinned to version N. Resolution for the account: its profile, then the workspace default, then `fp_platform`. The account's own `X-DM-Flow` header stays ignored. Must be a live profile of this workspace (400 `invalid_flow_profile`). On PATCH, omit it to keep the current assignment."},"credential_mode":{"type":"string","enum":["generated","email"],"default":"generated","description":"How the password is set. `generated` (default): returned once in `credentials`. `email`: nobody sees it. A single-use link (valid 72 hours) is mailed to the account's own address, and whoever opens it sets the password, plus the two-factor factor when `mfa_enabled` is true (`mfa_method` picks it; it is set up on the link's page, never shown to you). Needs `email`. The response then has `credentials: null` and `setup`."},"email_tag":{"type":"string","pattern":"^agent-[0-9a-hjkmnp-tv-z]{10}$","example":"agent-7k2m9qx4bd","description":"The tag to use in the address, so a client can show the exact address before saving (generate 10 random characters of `0-9 a-h j k m n p-t v-z`). Omit and the server picks one. A tag already in use is 409 `email_taken` (pick a new one and retry)."},"locale":{"type":"string","enum":["en","pt","he","no","nn","ro"],"description":"The language of the setup mail: one of the portal languages (the portal sends the one it shows). Omit to use your saved language preference in this workspace, else English. The link in the mail opens the page in that language."}},"required":["label","role"]},"SyntheticAccountCreatedDto":{"type":"object","properties":{"account":{"$ref":"#/components/schemas/SyntheticAccountDto"},"credentials":{"type":"object","additionalProperties":true,"nullable":true,"description":"The credential bundle (password, and MFA material when enabled), returned exactly once. `null` with `credential_mode: \"email\"`: nobody is shown the password."},"setup":{"nullable":true,"description":"Email mode: the setup link's state (also on `account.setup`). Null otherwise.","type":"object","allOf":[{"$ref":"#/components/schemas/SetupStateDto"}]}},"required":["account","credentials","setup"]},"EmailSetupDto":{"type":"object","properties":{"email":{"type":"string","maxLength":254,"example":"ops@example.com","description":"A verified email of yours to derive the address from (as on create). Omit, or send the account's current base, to keep its address. A different base (or a new `email_tag`) changes the account's sign-in address."},"email_tag":{"type":"string","pattern":"^agent-[0-9a-hjkmnp-tv-z]{10}$","example":"agent-7k2m9qx4bd","description":"As on create: the tag of a new address."},"mfa_method":{"type":"string","enum":["totp","email","none"],"description":"The two-factor factor whoever opens the link sets up: `totp`, `email` (codes to the account's address) or `none`. Omit to keep the account's choice; switching from a generated password keeps the factor type it had."},"locale":{"type":"string","enum":["en","pt","he","no","nn","ro"],"description":"The language of the setup mail: one of the portal languages (the portal sends the one it shows). Omit to use your saved language preference in this workspace, else English. The link in the mail opens the page in that language."}}},"SyntheticAccountEnvelopeDto":{"type":"object","properties":{"account":{"$ref":"#/components/schemas/SyntheticAccountDto"}},"required":["account"]},"UpdateSyntheticAccountDto":{"type":"object","properties":{"label":{"type":"string","minLength":1,"maxLength":120,"description":"One line (no line breaks)."},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only"]},"notes":{"type":"string","maxLength":2000},"flow_profile":{"type":"string","nullable":true,"pattern":"^fp_[A-Za-z0-9_]+(@[1-9][0-9]*)?$","maxLength":72,"description":"The flow profile requests authenticated as this account resolve to (owner only: sending this field, any value including `null`, needs `flow.write` on top of `team.write`, else 403 `missing_permission` and nothing is written). `null` = the workspace default; `fp_platform` = always today's behaviour (shields the account from the workspace default); `fp_…` = that profile's current version at request time; `fp_…@N` = pinned to version N. Resolution for the account: its profile, then the workspace default, then `fp_platform`. The account's own `X-DM-Flow` header stays ignored. Must be a live profile of this workspace (400 `invalid_flow_profile`). On PATCH, omit it to keep the current assignment."}}},"RotateMfaDto":{"type":"object","properties":{"method":{"type":"string","enum":["totp","email"],"description":"Factor type to provision in place of the old one. Omit to keep the current type (TOTP stays TOTP, email stays email; accounts with no factor yet get TOTP). `email` requires the account to have a deliverable mailbox — i.e. it was created with a base email; the default @agents.dispute.markets address is a sink and is rejected with 400."}}},"RevokeSessionsResultDto":{"type":"object","properties":{"id":{"type":"string","example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2","description":"The synthetic account (`sa_…`)."},"sessions_revoked_after":{"type":"string","format":"date-time","description":"The cut-off: every access token issued at or before this instant now answers 401 `session_revoked`."}},"required":["id","sessions_revoked_after"]},"ExpireSessionsResultDto":{"type":"object","properties":{"id":{"type":"string","example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2","description":"The synthetic account (`sa_…`)."},"sessions_expired_after":{"type":"string","format":"date-time","description":"The cut-off: every access token issued at or before this instant now answers 401 `session_expired`."}},"required":["id","sessions_expired_after"]},"MemberInvitedByDto":{"type":"object","properties":{"account_id":{"type":"string"},"email":{"type":"string","nullable":true,"format":"email"}},"required":["account_id","email"]},"MemberDto":{"type":"object","properties":{"id":{"type":"string","example":"wm_01J9Z3K4M5N6P7Q8R9S0T1V2W3","pattern":"^wm_[0-9A-Za-z]{24}$"},"account_id":{"type":"string","description":"The person's Auth account id."},"email":{"type":"string","nullable":true,"format":"email","description":"Sign-in e-mail, as of their last sign-in."},"username":{"type":"string","nullable":true},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only","owner"]},"joined_at":{"type":"string","format":"date-time"},"last_seen_at":{"type":"string","format":"date-time","nullable":true,"description":"Updated at most every 5 minutes."},"invited_by":{"nullable":true,"description":"Who sent the invite they joined with; null for the creator.","type":"object","allOf":[{"$ref":"#/components/schemas/MemberInvitedByDto"}]},"is_you":{"type":"boolean","description":"This row is the caller."}},"required":["id","account_id","email","username","role","joined_at","last_seen_at","invited_by","is_you"]},"MemberListDto":{"type":"object","properties":{"data":{"description":"People only, oldest member first; never synthetic accounts.","type":"array","items":{"$ref":"#/components/schemas/MemberDto"}},"pagination":{"$ref":"#/components/schemas/PaginationDto"}},"required":["data","pagination"]},"PreviewMemberDto":{"type":"object","properties":{"id":{"type":"string","example":"wm_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"email":{"type":"string","nullable":true,"format":"email"},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only","owner"]},"is_you":{"type":"boolean"}},"required":["id","email","role","is_you"]},"PreviewSyntheticDto":{"type":"object","properties":{"id":{"type":"string","example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"label":{"type":"string"},"email":{"type":"string","format":"email"},"role":{"type":"string"},"credential_mode":{"type":"string","enum":["generated","email"]},"mail_to_member":{"type":"boolean","description":"Its mail (setup links, password resets, sign-in codes) goes to the person: choose `move_to_me` or `archive`."},"credentials_known":{"type":"boolean","description":"The person saw or set its current password (they created it with a generated password, rotated it, or completed its setup link): its credentials are reset (`rotate`, the default) unless it is archived."}},"required":["id","label","email","role","credential_mode","mail_to_member","credentials_known"]},"PreviewItemDto":{"type":"object","properties":{"id":{"type":"string","example":"wh_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"type":{"type":"string","enum":["webhook","webhook_sink","playbook"]},"name":{"type":"string","description":"The webhook URL, the playbook name, or the sink id."},"enabled":{"type":"boolean"}},"required":["id","type","name","enabled"]},"PreviewInvitedDto":{"type":"object","properties":{"id":{"type":"string","example":"wm_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"email":{"type":"string","nullable":true,"format":"email"},"username":{"type":"string","nullable":true},"role":{"type":"string"},"joined_at":{"type":"string","format":"date-time"}},"required":["id","email","username","role","joined_at"]},"RemovalPreviewDto":{"type":"object","properties":{"member":{"$ref":"#/components/schemas/PreviewMemberDto"},"synthetic_accounts":{"description":"Live synthetic accounts whose mail goes to this person (each needs a disposition), or whose credentials they saw or set (reset unless archived).","type":"array","items":{"$ref":"#/components/schemas/PreviewSyntheticDto"}},"created_items":{"description":"Enabled webhooks, live webhook sinks and enabled playbooks they created in the portal (disabled unless kept).","type":"array","items":{"$ref":"#/components/schemas/PreviewItemDto"}},"invited_members":{"description":"People who joined with an invite this person sent (review them; nothing happens to them).","type":"array","items":{"$ref":"#/components/schemas/PreviewInvitedDto"}},"pending_invites_sent":{"type":"number","description":"Their pending invites here, cancelled with them."},"api_key_count":{"type":"number","nullable":true,"description":"Their active API keys here, which stop working; null when the auth service could not be asked."},"key_bound_webhooks":{"type":"number","description":"Enabled webhooks bound to those keys (disabled with the keys)."},"key_bound_playbooks":{"type":"number","description":"Enabled playbooks bound to those keys (disabled with the keys)."},"step_up_minutes":{"type":"number","nullable":true,"description":"Removing them needs a second factor proved within this many minutes (an owner); null when not."}},"required":["member","synthetic_accounts","created_items","invited_members","pending_invites_sent","api_key_count","key_bound_webhooks","key_bound_playbooks","step_up_minutes"]},"SyntheticDispositionDto":{"type":"object","properties":{"id":{"type":"string","pattern":"^sa_[0-9A-Za-z]{24}$","example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2W3","description":"A synthetic account whose mail goes to the person, or whose credentials they saw or set (`synthetic_accounts` of the removal preview)."},"action":{"type":"string","enum":["move_to_me","rotate","archive"],"description":"`move_to_me` (only when its mail goes to the person): its address moves onto one of your verified e-mails (same `agent-…` tag when free) and its setup, reset and sign-in mail comes to you from now on; any unused setup link stops working; and its credentials are reset, as with `rotate` (the person could reset its password from their inbox). `rotate`: its credentials are reset to ones nobody knows: a new password nobody is shown, every session ended; rotate its credentials (generated mode) or send a new setup link (email mode) to use it again. On an account mailed to the person it also moves the mail to you. The default for an account whose credentials the person knows but whose mail goes elsewhere. `archive`: the account is archived and signed out."}},"required":["id","action"]},"UpdateMemberDto":{"type":"object","properties":{"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only","owner"],"description":"`owner` (everything, including people, keys and settings; several owners are equal), `agent_full` (Full access: disputes, evidence, reports, playbooks, webhooks), `disputes_only`, `reports_only`, `read_only` (View only). The same roles as synthetic accounts, plus owner. Any change to or from owner needs a second factor proved within 5 minutes; to `agent_full` within 15. Demoting the last owner is 409 `last_owner`. You may demote yourself while another owner remains."},"synthetic_accounts":{"description":"Demoting an owner only: what happens to each synthetic account whose mail goes to them, or whose credentials they saw or set (`synthetic_accounts` of the removal preview). One entry per account mailed to them, else 400 `disposition_required` (`details.synthetic_accounts` lists the missing ids); an account they only hold credentials of defaults to `rotate`. `move_to_me` on an account not mailed to them is 400 `disposition_not_allowed`.","type":"array","items":{"$ref":"#/components/schemas/SyntheticDispositionDto"}}},"required":["role"]},"MemberEnvelopeDto":{"type":"object","properties":{"member":{"$ref":"#/components/schemas/MemberDto"}},"required":["member"]},"CreatedItemDispositionDto":{"type":"object","properties":{"id":{"type":"string","pattern":"^(wh|whs|pb)_[0-9A-Za-z]{24}$","example":"wh_01J9Z3K4M5N6P7Q8R9S0T1V2W3","description":"A webhook (`wh_…`), webhook sink (`whs_…`) or playbook (`pb_…`) the person created (from the removal preview)."},"action":{"type":"string","enum":["disable","keep"],"description":"`disable` (the default for any item not listed) or `keep` (you vouch for it; it keeps running)."}},"required":["id","action"]},"RemoveMemberDto":{"type":"object","properties":{"synthetic_accounts":{"description":"What happens to each synthetic account whose mail goes to the person, or whose credentials they saw or set (see the removal preview). One entry per account mailed to them, else 400 `disposition_required`; an account they only hold credentials of defaults to `rotate`. `move_to_me` on an account not mailed to them is 400 `disposition_not_allowed`.","type":"array","items":{"$ref":"#/components/schemas/SyntheticDispositionDto"}},"created_items":{"description":"Webhooks, webhook sinks and playbooks the person created: `keep` the ones you vouch for; every other one is disabled.","type":"array","items":{"$ref":"#/components/schemas/CreatedItemDispositionDto"}}}},"RemovalResultDto":{"type":"object","properties":{"api_keys_revoked":{"type":"number"},"webhooks_disabled":{"type":"number","description":"Their own webhooks disabled by the disposition, plus the ones bound to their keys."},"playbooks_disabled":{"type":"number"},"synthetic_accounts_moved":{"type":"number"},"synthetic_accounts_archived":{"type":"number"},"synthetic_credentials_reset":{"type":"number","description":"Synthetic accounts whose credentials were reset to ones nobody knows (the moved ones included): rotate their credentials, or send a new setup link, to use them again."}},"required":["api_keys_revoked","webhooks_disabled","playbooks_disabled","synthetic_accounts_moved","synthetic_accounts_archived","synthetic_credentials_reset"]},"MoveMailResultDto":{"type":"object","properties":{"id":{"type":"string","example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"email":{"type":"string","format":"email","description":"The account's sign-in address now."},"email_changed":{"type":"boolean","description":"False for an address on the agents.dispute.markets sink, which has no mailbox and keeps its address."}},"required":["id","email","email_changed"]},"InvitedByDto":{"type":"object","properties":{"account_id":{"type":"string","description":"Auth account id of the owner who sent it."},"email":{"type":"string","nullable":true,"format":"email","description":"Their sign-in e-mail."}},"required":["account_id","email"]},"InviteDto":{"type":"object","properties":{"id":{"type":"string","example":"wi_01J9Z3K4M5N6P7Q8R9S0T1V2W3","pattern":"^wi_[0-9A-Za-z]{24}$"},"email":{"type":"string","format":"email","example":"dana@acme.example"},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only","owner"]},"status":{"type":"string","enum":["pending","accepted","expired","revoked","bounced","send_failed"],"description":"`bounced`: the delivery check found the address on the suppression list after the send (the invite stops working)."},"send_status":{"type":"string","enum":["queued","sent","send_failed","suppressed","bounced"]},"invited_by":{"$ref":"#/components/schemas/InvitedByDto"},"created_at":{"type":"string","format":"date-time"},"expires_at":{"type":"string","format":"date-time","description":"7 days after the send; 72 hours for an owner invite."},"last_sent_at":{"type":"string","format":"date-time","nullable":true},"send_count":{"type":"number","description":"Sends to this address so far, this one included."},"accepted_at":{"type":"string","format":"date-time","nullable":true},"revoked_at":{"type":"string","format":"date-time","nullable":true},"revoke_reason":{"type":"string","nullable":true,"enum":["revoked","resent","inviter_lost_owner","workspace_deleted","bounced"]}},"required":["id","email","role","status","send_status","invited_by","created_at","expires_at","last_sent_at","send_count","accepted_at","revoked_at","revoke_reason"]},"InviteListDto":{"type":"object","properties":{"data":{"description":"Invites of the last 30 days, newest first (a resent invite shows once, as its latest send). One page: follow `pagination.next_cursor`.","type":"array","items":{"$ref":"#/components/schemas/InviteDto"}},"pagination":{"$ref":"#/components/schemas/PaginationDto"},"inviting_paused_until":{"type":"string","format":"date-time","nullable":true,"description":"When inviting is allowed again for you (the caller), in every workspace: a recipient marked one of your invites as spam in the last 24 h (docs/15 §10.3). Null when you can invite."}},"required":["data","pagination","inviting_paused_until"]},"CreateInviteDto":{"type":"object","properties":{"email":{"type":"string","format":"email","maxLength":254,"example":"dana@acme.example","description":"Who to invite. Stored trimmed and lowercased; plus tags and dots are kept, and the person must accept with exactly this address verified on their account."},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only","owner"],"description":"`owner` (everything, including people, keys and settings; several owners are equal), `agent_full` (Full access: disputes, evidence, reports, playbooks, webhooks), `disputes_only`, `reports_only`, `read_only` (View only). The same roles as synthetic accounts, plus owner. Inviting an owner needs a second factor proved within 5 minutes, `agent_full` within 15 (403 `step_up_required`)."},"locale":{"type":"string","enum":["en","pt","he","no","nn","ro"],"description":"The language of the invite mail: one of the portal languages (the portal sends the one it shows). Stored on the invite, so a resend keeps it. Omit to use your saved language preference in this workspace, else English. The link in the mail opens the page in that language."}},"required":["email","role"]},"InviteEnvelopeDto":{"type":"object","properties":{"invite":{"$ref":"#/components/schemas/InviteDto"}},"required":["invite"]},"ResendInviteDto":{"type":"object","properties":{"locale":{"type":"string","enum":["en","pt","he","no","nn","ro"],"description":"The language of the new mail (stored on the new invite). Omit to keep the invite's language."}}},"InviteTokenDto":{"type":"object","properties":{"token":{"type":"string","description":"The token from the invite link (`#token=dminv_…`). Never logged or recorded.","pattern":"^dminv_[A-Za-z0-9_-]{43}$","maxLength":64,"example":"dminv_3Q5mY0bQ8hZr8m2Yv1N7Xl6tWfT9cA4kJpR0sUeLzGd"}},"required":["token"]},"InviteWorkspaceDto":{"type":"object","properties":{"id":{"type":"string","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"name":{"type":"string"},"environment_label":{"type":"string","nullable":true,"example":"Production"},"environment_color":{"type":"string","nullable":true,"example":"#dc2626"}},"required":["id","name","environment_label","environment_color"]},"InviteInspectionDto":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/InviteWorkspaceDto"},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only","owner"]},"role_label":{"type":"string","example":"View only"},"inviter_email":{"type":"string","nullable":true,"format":"email","description":"The inviting owner's sign-in e-mail."},"email_masked":{"type":"string","example":"d•••@acme.example","description":"The invited address, masked."},"expires_at":{"type":"string","format":"date-time"}},"required":["workspace","role","role_label","inviter_email","email_masked","expires_at"]},"SessionTokensDto":{"type":"object","properties":{"access_token":{"type":"string"},"refresh_token":{"type":"string"},"token_type":{"type":"string","enum":["Bearer"]},"expires_in":{"type":"number","description":"Access token lifetime in seconds."}},"required":["access_token","refresh_token","token_type","expires_in"]},"AcceptInviteResultDto":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/InviteWorkspaceDto"},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only","owner"]},"session":{"nullable":true,"description":"Tokens of the session switched into the workspace. Null when the switch failed: you are a member; switch to it later.","type":"object","allOf":[{"$ref":"#/components/schemas/SessionTokensDto"}]}},"required":["workspace","role","session"]},"WorkspaceDto":{"type":"object","properties":{"id":{"type":"string","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","pattern":"^tnt_[0-9A-Za-z]{24}$"},"name":{"type":"string","example":"Acme staging"},"company":{"type":"string","nullable":true},"environment_label":{"type":"string","nullable":true,"example":"Staging"},"environment_color":{"type":"string","nullable":true,"example":"#d97706"},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only","owner"],"description":"Your role in it."},"role_label":{"type":"string","example":"Owner","description":"Your role as the portal names it."},"is_current":{"type":"boolean","description":"The workspace this session is in."},"joined_at":{"type":"string","format":"date-time","description":"When you joined (or created) it."},"member_count":{"type":"number","nullable":true,"description":"People in it (never synthetic accounts); null for a synthetic account."},"owner_emails":{"description":"Sign-in e-mails of its owners, so you know whom to ask. Empty for a synthetic account.","example":["dana@acme.example"],"type":"array","items":{"type":"string"}},"created_by_you":{"type":"boolean","description":"You created it (it counts toward your limit while you are still an owner)."}},"required":["id","name","company","environment_label","environment_color","role","role_label","is_current","joined_at","member_count","owner_emails","created_by_you"]},"WorkspaceLimitsDto":{"type":"object","properties":{"created":{"type":"number","description":"Workspaces you created and still own."},"max_created":{"type":"number","example":10},"memberships":{"type":"number","description":"Workspaces you belong to."},"max_memberships":{"type":"number","example":50}},"required":["created","max_created","memberships","max_memberships"]},"WorkspaceListDto":{"type":"object","properties":{"data":{"description":"Your workspaces in pipeline order: Development, Staging, Production, then Sandbox, then other labels A–Z, then no label; by name within a label. A synthetic account sees only its own.","type":"array","items":{"$ref":"#/components/schemas/WorkspaceDto"}},"pagination":{"description":"At most 100 per page (default 50, the membership limit), so one page in practice; follow `next_cursor` while `has_more`.","allOf":[{"$ref":"#/components/schemas/PaginationDto"}]},"limits":{"description":"Your limits; the same on every page.","allOf":[{"$ref":"#/components/schemas/WorkspaceLimitsDto"}]}},"required":["data","pagination","limits"]},"CreateWorkspaceDto":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80,"example":"Acme staging","description":"The workspace name (trimmed)."},"company":{"type":"string","nullable":true,"maxLength":120,"description":"Company or organisation (trimmed); shown as secondary text."},"environment_label":{"type":"string","nullable":true,"maxLength":24,"example":"Staging","description":"Environment label (trimmed; up to 24 characters). Suggested: `Development`, `Staging`, `Production`, `Sandbox`. Cosmetic: no permission, key or flow depends on it."},"environment_color":{"type":"string","nullable":true,"pattern":"^#[0-9a-fA-F]{6}$","example":"#d97706","description":"`#rrggbb`, stored lower case. Omitted with a suggested label: that label's colour (Development `#0d9488`, Staging `#d97706`, Production `#dc2626`, Sandbox `#7c3aed`)."},"copy_settings_from":{"type":"string","nullable":true,"pattern":"^tnt_[0-9A-Za-z]{24}$","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","description":"A workspace you own: the new one starts with its default currency and time zone (nothing else is copied: no flow profiles, keys, webhooks or data). 404 `workspace_not_found` when it is not a workspace you own."}},"required":["name"]},"CreateWorkspaceResultDto":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/WorkspaceDto"},"session":{"nullable":true,"description":"Tokens of the session switched into the new workspace. Null when the switch failed: it exists; switch to it later.","type":"object","allOf":[{"$ref":"#/components/schemas/SessionTokensDto"}]}},"required":["workspace","session"]},"DeletionCountsDto":{"type":"object","properties":{"transactions":{"type":"number","description":"Transactions (synthetic data included)."},"disputes":{"type":"number"},"reports":{"type":"number","description":"Reports not deleted yet."},"webhooks":{"type":"number"},"people":{"type":"number","description":"People who are members (you included); never synthetic accounts."},"synthetic_accounts":{"type":"number","description":"Synthetic accounts that are not archived."},"api_keys":{"type":"number","nullable":true,"description":"Active API keys; null when the authentication service could not be asked (then a second factor is required)."}},"required":["transactions","disputes","reports","webhooks","people","synthetic_accounts","api_keys"]},"DeletionPreviewDto":{"type":"object","properties":{"id":{"type":"string","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","pattern":"^tnt_[0-9A-Za-z]{24}$"},"name":{"type":"string","example":"Acme staging","description":"The name to type in `confirm_name`."},"environment_label":{"type":"string","nullable":true,"example":"Staging"},"counts":{"$ref":"#/components/schemas/DeletionCountsDto"},"step_up_required":{"type":"boolean","description":"True unless the workspace is empty (every count but `people` is 0) and you are its only member: then the typed name is enough. Otherwise the delete needs a second factor proved within `step_up_max_age_minutes` (`POST /v1/auth/mfa/step-up`, then `POST /v1/auth/refresh`)."},"step_up_max_age_minutes":{"type":"number","example":5},"purge_after_days":{"type":"number","example":30,"description":"Days after the delete when the data is purged for good."}},"required":["id","name","environment_label","counts","step_up_required","step_up_max_age_minutes","purge_after_days"]},"DeleteWorkspaceDto":{"type":"object","properties":{"confirm_name":{"type":"string","maxLength":80,"example":"Acme staging","description":"The workspace's name, typed exactly (case and spelling; surrounding spaces are ignored). Anything else is 400 `confirm_name_mismatch`."}},"required":["confirm_name"]},"DeleteWorkspaceResultDto":{"type":"object","properties":{"id":{"type":"string","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","pattern":"^tnt_[0-9A-Za-z]{24}$","description":"The deleted workspace (its tombstone keeps this id)."},"deleted_at":{"type":"string","format":"date-time"},"purge_after":{"type":"string","format":"date-time","description":"When the data is purged for good (30 days after `deleted_at`)."},"next_workspace_id":{"type":"string","nullable":true,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","description":"Your default workspace now; null when you have none left (then create one or accept an invite)."},"session":{"nullable":true,"description":"When the session was in the deleted workspace: tokens switched into `next_workspace_id`. Null otherwise, or with no workspace left.","type":"object","allOf":[{"$ref":"#/components/schemas/SessionTokensDto"}]}},"required":["id","deleted_at","purge_after","next_workspace_id","session"]},"SwitchWorkspaceDto":{"type":"object","properties":{"workspace_id":{"type":"string","pattern":"^tnt_[0-9A-Za-z]{24}$","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","description":"A workspace you are a member of."}},"required":["workspace_id"]},"LeaveSyntheticDispositionDto":{"type":"object","properties":{"id":{"type":"string","pattern":"^sa_[0-9A-Za-z]{24}$","example":"sa_01J9Z3K4M5N6P7Q8R9S0T1V2W3","description":"A synthetic account whose mail goes to you, or whose credentials you saw or set (from the removal preview)."},"action":{"type":"string","enum":["archive","rotate"],"description":"`archive` (archived and signed out). `rotate`: only for an account whose credentials you know but whose mail goes elsewhere; its credentials are reset to ones nobody knows (also what happens when it is not listed). An account whose mail goes to you can only be archived; to keep one, ask another owner to move its mail to them before you leave."}},"required":["id","action"]},"LeaveWorkspaceDto":{"type":"object","properties":{"synthetic_accounts":{"description":"Each live synthetic account of the workspace whose mail goes to you, with `archive`. Any left out answers 409 `synthetic_mail_owner` (`details.synthetic_accounts`). Accounts whose credentials you saw or set (generated passwords you were shown, setup links you completed) but whose mail goes elsewhere have their credentials reset to ones nobody knows, unless listed with `archive`.","type":"array","items":{"$ref":"#/components/schemas/LeaveSyntheticDispositionDto"}}}},"LeaveResultDto":{"type":"object","properties":{"next_workspace_id":{"type":"string","nullable":true,"example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","description":"Your default workspace now; null when you have none left."},"session":{"nullable":true,"description":"When the session was in the workspace you left (its token is refused there from now on): tokens switched into `next_workspace_id`. Null otherwise, or with no workspace left (refresh the session to get one without a workspace).","type":"object","allOf":[{"$ref":"#/components/schemas/SessionTokensDto"}]},"invites_revoked":{"type":"number","description":"Pending invites you had sent there, now cancelled."},"synthetic_accounts_archived":{"type":"number"},"synthetic_credentials_reset":{"type":"number","description":"Synthetic accounts whose credentials you knew, now reset to ones nobody knows (an owner rotates them, or sends a new setup link, to use them again)."},"webhooks_disabled":{"type":"number","description":"Webhooks you created there, now disabled."},"sinks_disabled":{"type":"number"},"playbooks_disabled":{"type":"number"},"tasks_canceled":{"type":"number","description":"Your queued or running background tasks there, now cancelled."}},"required":["next_workspace_id","session","invites_revoked","synthetic_accounts_archived","synthetic_credentials_reset","webhooks_disabled","sinks_disabled","playbooks_disabled","tasks_canceled"]},"MyInviteDto":{"type":"object","properties":{"id":{"type":"string","example":"wi_01J9Z3K4M5N6P7Q8R9S0T1V2W3","pattern":"^wi_[0-9A-Za-z]{24}$"},"email":{"type":"string","format":"email","description":"Which of your verified addresses it was sent to."},"workspace":{"$ref":"#/components/schemas/InviteWorkspaceDto"},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only","owner"]},"role_label":{"type":"string","example":"View only"},"inviter_email":{"type":"string","nullable":true,"format":"email","description":"The inviting owner's sign-in e-mail."},"expires_at":{"type":"string","format":"date-time"}},"required":["id","email","workspace","role","role_label","inviter_email","expires_at"]},"MyInviteListDto":{"type":"object","properties":{"data":{"description":"Newest first. One page: follow `pagination.next_cursor`.","type":"array","items":{"$ref":"#/components/schemas/MyInviteDto"}},"pagination":{"$ref":"#/components/schemas/PaginationDto"}},"required":["data","pagination"]},"SignupDto":{"type":"object","properties":{"username":{"type":"string","minLength":3,"example":"jane_doe"},"email":{"type":"string","example":"jane@acme.example"},"password":{"type":"string","minLength":8,"example":"CorrectHorseBatteryStaple"},"display_name":{"type":"string","example":"Jane Doe"},"company_name":{"type":"string","description":"Optional company name used to seed the tenant display name on first signin."},"invite_token":{"type":"string","description":"The token of a workspace invite (`#token=dminv_…` of the invite link). The account is then created WITHOUT a workspace of its own: verify the e-mail (`POST /v1/auth/verify-email/confirm`), then accept (`POST /v1/auth/invites/accept`, or `POST /v1/me/invites/{id}/accept`). Checked first, like `POST /v1/auth/invites/inspect`: 404 `invite_invalid`, 410 `invite_expired` | `invite_used` | `invite_revoked`, and nothing is created. Never logged or recorded.","pattern":"^dminv_[A-Za-z0-9_-]{43}$","maxLength":64},"locale":{"type":"string","enum":["en","pt","he","no","nn","ro"],"description":"The portal language the person uses: the new sandbox workspace is named in it (`Ambiente de testes de jane_doe` for `pt`). Omit for English. The environment label stays the suggested label `Sandbox`, which the portal translates on display."}},"required":["username","email","password"]},"AuthTokensDto":{"type":"object","properties":{"access_token":{"type":"string","description":"Bearer access token. Never log it."},"refresh_token":{"type":"string","description":"Refresh token for `POST /v1/auth/refresh`. Never log it."},"token_type":{"type":"string","enum":["Bearer"]},"expires_in":{"type":"number","description":"Access token lifetime in seconds.","example":900}},"required":["access_token","refresh_token","token_type","expires_in"]},"SigninDto":{"type":"object","properties":{"identifier":{"type":"string","description":"Username OR verified primary email — both accepted.","example":"jane_doe"},"password":{"type":"string"},"workspace_id":{"type":"string","description":"Workspace (`tnt_…`) to land in. Honoured only when the account is a live member of it; otherwise (or when omitted) the session lands in the default workspace: the one last switched to, then the oldest joined. Ignored for synthetic accounts, which always land in their own workspace.","pattern":"^tnt_[0-9A-Za-z]{24}$","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},"required":["identifier","password"]},"MfaSendCodeDto":{"type":"object","properties":{"mfa_token":{"type":"string","description":"Single-use challenge id from a `mfa_required: true` sign-in response.","minLength":1,"maxLength":64},"factor_id":{"type":"string","description":"Id of the `email` factor (from the challenge `factors` list) to deliver the code through."}},"required":["mfa_token","factor_id"]},"MfaVerifyDto":{"type":"object","properties":{"mfa_token":{"type":"string","description":"Single-use challenge id from a `mfa_required: true` sign-in response.","minLength":1,"maxLength":64},"code":{"type":"string","example":"123456","description":"6-digit TOTP code."},"workspace_id":{"type":"string","description":"Workspace (`tnt_…`) to land in. Honoured only when the account is a live member of it; otherwise (or when omitted) the session lands in the default workspace: the one last switched to, then the oldest joined. Ignored for synthetic accounts, which always land in their own workspace.","pattern":"^tnt_[0-9A-Za-z]{24}$","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},"required":["mfa_token","code"]},"MfaRecoverDto":{"type":"object","properties":{"mfa_token":{"type":"string","minLength":1,"maxLength":64},"recovery_code":{"type":"string","description":"16-hex recovery code; hyphens optional.","minLength":16,"maxLength":24,"example":"a1b2-c3d4-e5f6-7890"},"workspace_id":{"type":"string","description":"Workspace (`tnt_…`) to land in. Honoured only when the account is a live member of it; otherwise (or when omitted) the session lands in the default workspace: the one last switched to, then the oldest joined. Ignored for synthetic accounts, which always land in their own workspace.","pattern":"^tnt_[0-9A-Za-z]{24}$","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},"required":["mfa_token","recovery_code"]},"StartFactorEnrollmentDto":{"type":"object","properties":{"type":{"type":"string","enum":["totp"],"example":"totp"},"label":{"type":"string","maxLength":64}},"required":["type"]},"ConfirmFactorEnrollmentDto":{"type":"object","properties":{"codes":{"description":"Two TOTP codes from consecutive 30-second windows of the user's authenticator.","minItems":2,"maxItems":2,"example":["123456","654321"],"type":"array","items":{"type":"string"}}},"required":["codes"]},"StepUpSendCodeDto":{"type":"object","properties":{"factor_id":{"type":"string","description":"Id of the enabled `email` factor to deliver the code through. Defaults to the first enabled email factor.","minLength":1,"maxLength":64}}},"StepUpSendCodeResponseDto":{"type":"object","properties":{"email_masked":{"type":"string","description":"Masked address the code was sent to.","example":"a***a@e***e.com"},"code_expires_at":{"type":"string","format":"date-time","description":"When the code stops working (5 minutes)."}},"required":["email_masked","code_expires_at"]},"StepUpDto":{"type":"object","properties":{"code":{"type":"string","description":"TOTP code (6 digits) OR recovery code (16 hex, hyphens optional).","minLength":6,"maxLength":40}},"required":["code"]},"StepUpResponseDto":{"type":"object","properties":{"amr":{"description":"Authentication methods of this session after the step-up.","example":["pwd","otp"],"type":"array","items":{"type":"string"}},"mfa_at":{"type":"string","format":"date-time","description":"When the session last proved a second factor."}},"required":["amr","mfa_at"]},"RefreshDto":{"type":"object","properties":{"refresh_token":{"type":"string","description":"Refresh token returned from a previous sign-in / mfa-verify response."}},"required":["refresh_token"]},"BootstrapDto":{"type":"object","properties":{"locale":{"type":"string","enum":["en","pt","he","no","nn","ro"],"description":"The portal language the person uses: the new sandbox workspace is named in it (`Ambiente de testes de jane_doe` for `pt`). Omit for English. The environment label stays the suggested label `Sandbox`, which the portal translates on display."}}},"AuthMeWorkspaceDto":{"type":"object","properties":{"id":{"type":"string","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3","description":"The workspace this session acts in (what `X-DM-Workspace` must name)."},"name":{"type":"string","example":"Acme sandbox"},"company":{"type":"string","nullable":true,"example":"Acme Inc."},"environment_label":{"type":"string","nullable":true,"maxLength":24,"example":"Staging","description":"The workspace environment label; null = none."},"environment_color":{"type":"string","nullable":true,"pattern":"^#[0-9a-f]{6}$","example":"#d97706","description":"Accent colour of the environment label; null = the default."}},"required":["id","name","company","environment_label","environment_color"]},"WorkspaceSettingsDto":{"type":"object","properties":{"object":{"type":"string","enum":["workspace_settings"]},"id":{"type":"string","description":"The workspace (tenant) id.","example":"tnt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"name":{"type":"string","description":"The workspace name shown in the portal.","maxLength":80,"example":"Ana's sandbox"},"company":{"type":"string","nullable":true,"maxLength":120,"example":"Acme Inc."},"default_currency":{"type":"string","nullable":true,"pattern":"^[A-Z]{3}$","example":"EUR","description":"ISO 4217 currency the dashboard and generate default to; null = none (the dashboard sums every currency, as before). Tenant-shared: every member of the workspace sees it."},"default_time_zone":{"type":"string","nullable":true,"example":"Europe/Lisbon","description":"IANA time zone for members who did not choose one (their `preferences.time_zone` wins); null = UTC. Tenant-shared: every member of the workspace sees it."},"environment_label":{"type":"string","nullable":true,"maxLength":24,"example":"STAGING-QA","description":"Shown in the portal top bar and tab title, so teams with several sandboxes do not act in the wrong one; null = none."},"environment_color":{"type":"string","nullable":true,"pattern":"^#[0-9a-f]{6}$","example":"#d97706","description":"Accent colour of the environment label (`#rrggbb`, lower case); null = the default."},"version":{"type":"integer","minimum":0,"description":"Counts the changes; 0 = never changed."},"updated_at":{"type":"string","format":"date-time","nullable":true,"description":"When the settings last changed; null = never."}},"required":["object","id","name","company","default_currency","default_time_zone","environment_label","environment_color","version","updated_at"]},"UserPreferencesDto":{"type":"object","properties":{"object":{"type":"string","enum":["user_preferences"]},"time_zone":{"type":"string","nullable":true,"example":"Europe/Lisbon","description":"The IANA zone this user chose; null = the workspace zone, then UTC."},"effective_time_zone":{"type":"string","example":"Europe/Lisbon","description":"The zone to show dates in: `time_zone`, else the workspace `default_time_zone`, else `UTC`. Never the browser zone, so server and browser rendering agree."},"locale":{"type":"string","nullable":true,"enum":["en","pt","he","no","nn","ro"],"description":"Portal language; null = from the URL, else English."},"date_format":{"type":"string","enum":["locale","iso"],"description":"`locale` formats dates for the language; `iso` uses ISO 8601."},"hour_cycle":{"type":"string","nullable":true,"enum":["h12","h23"],"description":"`h23` = 24-hour clock, `h12` = 12-hour; null = the language default."},"page_size":{"type":"integer","enum":[25,50,100,200],"description":"Rows per page in lists."},"disputes_default_tab":{"type":"string","enum":["unanswered","all"],"description":"The disputes list tab opened by default."},"theme":{"type":"string","enum":["light","dark","system"],"description":"Portal appearance. `system` (the default) follows the device setting."},"updated_at":{"type":"string","format":"date-time","nullable":true,"description":"When this user last changed them; null = never (all defaults)."}},"required":["object","time_zone","effective_time_zone","locale","date_format","hour_cycle","page_size","disputes_default_tab","theme","updated_at"]},"AuthMeFlowDto":{"type":"object","properties":{"default_profile_id":{"type":"string","example":"fp_platform","description":"The workspace default flow profile."},"request_profile_id":{"type":"string","example":"fp_platform","description":"The flow profile this request ran under."},"request_profile_source":{"type":"string","enum":["header","account","tenant_default"],"description":"Where `request_profile_id` came from."}},"required":["default_profile_id","request_profile_id","request_profile_source"]},"AuthMeFeaturesDto":{"type":"object","properties":{"multi_workspace":{"type":"boolean","description":"People, invites and several workspaces are on for this person (docs/15 §14). Always false for a synthetic account."}},"required":["multi_workspace"]},"AuthMeDto":{"type":"object","properties":{"sub":{"type":"string","description":"The account id on the sign-in service."},"username":{"type":"string","nullable":true},"email":{"type":"string","nullable":true,"format":"email","description":"The primary sign-in e-mail."},"email_verified":{"type":"boolean","description":"The primary e-mail is verified; the portal gates every page but verify-email on it."},"display_name":{"type":"string","nullable":true},"role":{"type":"string","nullable":true,"description":"The sign-in service role of the account (not the workspace role)."},"tenant_id":{"type":"string","nullable":true,"format":"uuid","description":"Internal id of the current workspace; null for a session without one. Use `workspace.id` (`tnt_…`)."},"heimdall_tenant_id":{"type":"string","nullable":true,"description":"The sign-in service tenant of the current workspace; null without one."},"tenant_role":{"type":"string","nullable":true,"enum":["owner","agent_full","disputes_only","reports_only","read_only"],"description":"The role in the current workspace; null without one."},"is_owner":{"type":"boolean","description":"The role in the current workspace is owner."},"is_human":{"type":"boolean","description":"A person (true) or a synthetic account (false)."},"permissions":{"example":["dispute.read","report.read"],"description":"What this session may do in the current workspace.","type":"array","items":{"type":"string"}},"workspace":{"nullable":true,"description":"The workspace this session acts in, with its environment label; null for a session without a workspace (after signing up from an invite, or after leaving the last one).","type":"object","allOf":[{"$ref":"#/components/schemas/AuthMeWorkspaceDto"}]},"workspace_settings":{"description":"The current workspace settings. Absent without a workspace.","allOf":[{"$ref":"#/components/schemas/WorkspaceSettingsDto"}]},"preferences":{"description":"This person's preferences in the current workspace. Absent without a workspace.","allOf":[{"$ref":"#/components/schemas/UserPreferencesDto"}]},"flow":{"description":"Present only with `flow.read` in a workspace.","allOf":[{"$ref":"#/components/schemas/AuthMeFlowDto"}]},"features":{"$ref":"#/components/schemas/AuthMeFeaturesDto"}},"required":["sub","username","email","email_verified","display_name","role","tenant_id","heimdall_tenant_id","tenant_role","is_owner","is_human","permissions","workspace","features"]},"VerifyEmailDto":{"type":"object","properties":{"code":{"type":"string","minLength":4,"example":"123456"}},"required":["code"]},"ForgotPasswordDto":{"type":"object","properties":{"email":{"type":"string"}},"required":["email"]},"ResetPasswordDto":{"type":"object","properties":{"code":{"type":"string","minLength":4},"new_password":{"type":"string","minLength":8}},"required":["code","new_password"]},"AddEmailDto":{"type":"object","properties":{"email":{"type":"string","example":"ops@example.com","maxLength":254}},"required":["email"]},"VerifyEmailCodeDto":{"type":"object","properties":{"code":{"type":"string","minLength":4,"example":"123456"}},"required":["code"]},"SetupTokenDto":{"type":"object","properties":{"token":{"type":"string","description":"The token from the setup link (`#token=dmsu_…`). An empty or blank token is 400 `validation_failed`.","example":"dmsu_Q2hhbmdlIG1lOiB0aGlzIGlzIG5vdCBhIHJlYWwgdG9rZW4uLi4","minLength":1,"maxLength":200}},"required":["token"]},"PasswordPolicyDto":{"type":"object","properties":{"min_length":{"type":"number","example":8}},"required":["min_length"]},"SetupDetailsDto":{"type":"object","properties":{"label":{"type":"string","description":"The account's label in the workspace."},"workspace_name":{"type":"string"},"sign_in_email":{"type":"string","description":"The address to sign in with (the `identifier` of `POST /v1/auth/signin`)."},"username":{"type":"string","nullable":true,"description":"The username, which also signs in; null when unknown."},"role":{"type":"string","enum":["agent_full","disputes_only","reports_only","read_only"]},"expires_at":{"type":"string","format":"date-time"},"mfa_method":{"type":"string","enum":["totp","email"],"nullable":true,"description":"The two-factor factor set up with the password (shown once in the complete response); null: none."},"password_policy":{"$ref":"#/components/schemas/PasswordPolicyDto"}},"required":["label","workspace_name","sign_in_email","username","role","expires_at","mfa_method","password_policy"]},"CompleteSetupDto":{"type":"object","properties":{"token":{"type":"string","description":"The token from the setup link (`#token=dmsu_…`). An empty or blank token is 400 `validation_failed`.","example":"dmsu_Q2hhbmdlIG1lOiB0aGlzIGlzIG5vdCBhIHJlYWwgdG9rZW4uLi4","minLength":1,"maxLength":200},"new_password":{"type":"string","minLength":8,"maxLength":256,"description":"The password to set. Auth applies its password policy and refuses passwords found in known breaches."}},"required":["token","new_password"]},"SetupMfaDto":{"type":"object","properties":{"method":{"type":"string","enum":["totp","email"]},"totp_uri":{"type":"string","description":"TOTP only: the otpauth:// URI for an authenticator app."},"totp_secret":{"type":"string","description":"TOTP only: the shared secret (Base32)."},"totp_qr_data_url":{"type":"string","description":"TOTP only: a PNG data URL of the QR code."},"recovery_codes":{"description":"Single-use recovery codes.","type":"array","items":{"type":"string"}}},"required":["method","recovery_codes"]},"SetupCompletedDto":{"type":"object","properties":{"sign_in_email":{"type":"string"},"username":{"type":"string","nullable":true},"mfa":{"nullable":true,"description":"The two-factor material, returned exactly once; null when the account has no two-factor.","type":"object","allOf":[{"$ref":"#/components/schemas/SetupMfaDto"}]}},"required":["sign_in_email","username","mfa"]},"GenerateJobResultDto":{"type":"object","properties":{"transactions":{"type":"number","minimum":0,"example":5},"disputes":{"type":"number","minimum":0,"example":5}},"required":["transactions","disputes"]},"CleanupCountsDto":{"type":"object","properties":{"transactions":{"type":"number","minimum":0},"disputes":{"type":"number","minimum":0},"dispute_events":{"type":"number","minimum":0},"payment_events":{"type":"number","minimum":0},"evidence":{"type":"number","minimum":0}},"required":["transactions","disputes","dispute_events","payment_events","evidence"]},"GenerateProgressDto":{"type":"object","properties":{"done":{"type":"integer","minimum":0,"description":"Transactions committed so far.","example":1000},"total":{"type":"integer","minimum":0,"description":"Transactions the job creates.","example":5000},"unit":{"type":"string","enum":["transactions"]},"pct":{"type":"integer","minimum":0,"maximum":100,"description":"Whole percent, rounded down.","example":20}},"required":["done","total","unit","pct"]},"GenerateDto":{"type":"object","properties":{"count":{"type":"number","minimum":1,"maximum":20000,"description":"How many synthetic transactions to mint in this run (API keys: at most 500). The sum over the tenant's unfinished jobs may not exceed 20,000, of which jobs started by API keys may hold at most 5,000.","example":100},"dispute_rate":{"type":"number","minimum":0,"maximum":1,"description":"Fraction of generated transactions that get an associated dispute.","example":0.2},"currency":{"type":"string","enum":["USD","EUR","GBP","CAD","AUD","JPY"]},"range_days":{"type":"number","minimum":1,"maximum":365,"description":"Spread the generated timestamps across this many trailing days.","example":30},"seed":{"type":"integer","minimum":0,"maximum":2147483647,"description":"Seed for the generator. The same seed with the same count, dispute_rate, currency and range_days produces the same shapes (merchants, amounts, statuses, reason codes); timestamps are relative to when the job was created and ids are always new. Shapes can change between API versions (not byte-equal across releases). Omit for a random run.","example":7},"lifecycle":{"type":"string","enum":["auto","manual"],"description":"`manual` pins the created disputes: the hourly lifecycle cron skips them and only an advance-lifecycle that targets them (by `dispute_ids` or `generate_job_id`) moves them. Default `auto` for users, `manual` for API keys. A flow profile with `lifecycle.windows` or `lifecycle.review` makes the disputes `scheduled` whatever the default; sending `manual` explicitly with such a profile is 400 `lifecycle_conflict`."}},"required":["count","dispute_rate","currency","range_days"]},"GenerateTrickleDto":{"type":"object","properties":{"per_minute":{"type":"integer","minimum":1,"maximum":60,"description":"Disputes per batch (`generate.trickle.per_minute`).","example":2},"duration_s":{"type":"integer","minimum":60,"maximum":86400,"description":"How long the trickle runs, in seconds.","example":180},"batches_total":{"type":"integer","minimum":1,"description":"Batches the job runs: the first at once, then one a minute.","example":3},"batches_done":{"type":"integer","minimum":0,"description":"Batches committed so far.","example":1}},"required":["per_minute","duration_s","batches_total","batches_done"]},"GenerateJobResponseDto":{"type":"object","properties":{"id":{"type":"string","description":"The job id (`gj_…`). Use it to poll, filter lists, advance and clean up.","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3","pattern":"^gj_[0-9A-Z]{24}$"},"job_id":{"type":"string","format":"uuid","deprecated":true,"description":"Deprecated alias: the internal uuid of the job. Still accepted by `GET /v1/dev/generate/:id`; use `id` instead."},"status":{"type":"string","enum":["pending","running","completed","failed","canceled"],"description":"`pending` until the first chunk runs, `running` while chunks run, then `completed`, `failed` or `canceled` (by `POST /v1/dev/generate-jobs/:id/cancel` or a cleanup; the committed rows are kept until cleanup)."},"lifecycle":{"type":"string","enum":["auto","manual"],"description":"`manual`: the job's disputes are pinned; the hourly lifecycle cron skips them and only a targeted `POST /v1/dev/advance-lifecycle` moves them."},"lifecycle_mode":{"type":"string","enum":["auto","manual","scheduled"],"description":"The lifecycle of the job's disputes: `auto` (the hourly lifecycle pass), `manual` (pinned; only a targeted advance-lifecycle moves them) or `scheduled` (the stamped `lifecycle.windows` / `lifecycle.review` run each dispute's deadline and ruling as scheduled jobs; fast-forward them with `POST /v1/scheduled-jobs/fast-forward`)."},"flow":{"type":"object","additionalProperties":true,"nullable":true,"description":"The flow snapshot stamped on every dispute of the job (`{profile_id, version, source, variants}` with the concrete `lifecycle.ruling`, `lifecycle.windows`, `lifecycle.review`, `lifecycle.webhooks`, `generate.profile` and `generate.trickle`). Null for jobs created before lifecycle profiles; jobs created before generate profiles have no `generate.*` keys (they ran as the defaults).","example":{"profile_id":"fp_platform","version":null,"source":"platform","variants":{"lifecycle.ruling":{"mode":"random"},"lifecycle.windows":null,"lifecycle.review":null,"lifecycle.webhooks":{"enabled":false},"generate.profile":{"mix":"realistic","deadline_anchor":"opened"},"generate.trickle":null}}},"seed":{"type":"integer","nullable":true,"description":"PRNG seed the job ran with; null for a random run.","example":7},"count":{"type":"integer","nullable":true,"description":"Transactions requested.","example":5},"correlation_id":{"type":"string","nullable":true,"description":"X-Correlation-Id of the request that started the job."},"result":{"nullable":true,"description":"Rows created; null until the job completes.","type":"object","allOf":[{"$ref":"#/components/schemas/GenerateJobResultDto"}]},"error":{"type":"string","nullable":true,"description":"A fixed sentence when the job failed or was canceled."},"error_code":{"type":"string","nullable":true,"enum":["generate_failed","job_lease_expired","canceled","tenant_data_limit"],"description":"Stable code of `error`; branch on this, not on the sentence. Null while the job runs or after it completed."},"progress":{"nullable":true,"description":"Transactions committed so far, out of the total; null only on jobs from before chunked generate.","type":"object","allOf":[{"$ref":"#/components/schemas/GenerateProgressDto"}]},"started_at":{"type":"string","format":"date-time","nullable":true,"description":"When the first chunk started; null while `pending`."},"created_so_far":{"type":"integer","minimum":0,"description":"Transactions created so far (committed chunks or trickle batches). In a `generate.trickle` job every transaction carries a dispute, so this is the disputes created so far.","example":4},"trickle":{"nullable":true,"description":"The `generate.trickle` plan of the job and its batches done; null for an ordinary job. Fast-forward the job (`POST /v1/scheduled-jobs/fast-forward {generate_job_id}`) to run the next batch at once.","type":"object","allOf":[{"$ref":"#/components/schemas/GenerateTrickleDto"}]},"eta_at":{"type":"string","format":"date-time","nullable":true,"description":"Estimated finish while the job runs: the time of the last committed chunk plus the remaining transactions at the recent throughput (null until two chunks have committed). For a `generate.trickle` job: when its last batch runs (known from the start). Null once the job is no longer running."},"created_at":{"format":"date-time","type":"string"},"finished_at":{"type":"string","format":"date-time","nullable":true},"dispute_ids":{"nullable":true,"description":"On `GET /v1/dev/generate/:id` only: display ids (`dsp_…`) of the disputes this job created that still exist, oldest first, once the job has completed; null before.","example":["dsp_01J9Z3K4M5N6P7Q8R9S0T1V2W3"],"type":"array","items":{"type":"string"}},"background_task_id":{"type":"string","nullable":true,"pattern":"^bt_[0-9A-Z]{24}$","description":"On `POST /v1/dev/generate` only: the background task (`bt_…`) that follows the job in the signed-in user's portal tray. Null for API keys, which get no task."}},"required":["id","job_id","status","lifecycle","lifecycle_mode","flow","seed","count","correlation_id","result","error","error_code","progress","started_at","created_so_far","trickle","eta_at","created_at","finished_at"]},"CleanupDto":{"type":"object","properties":{"async":{"type":"boolean","description":"`false`: clean up in this request (200 with the counts), whatever the size. `true`: always as a background task (202). Omitted: in the request when the job holds at most 2,000 transactions, else in the background.","example":false}}},"CleanupResponseDto":{"type":"object","properties":{"id":{"type":"string","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"deleted":{"$ref":"#/components/schemas/CleanupCountsDto"}},"required":["id","deleted"]},"CleanupAcceptedDto":{"type":"object","properties":{"id":{"type":"string","description":"The generate job (`gj_…`).","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"state":{"type":"string","enum":["queued","running"],"description":"`running` when a cleanup of this job was already under way and is returned."},"background_task_id":{"type":"string","nullable":true,"description":"The `generate.cleanup` background task (`bt_…`) that follows the cleanup in `GET /v1/me/background-tasks`; its `result.counts` holds the totals when it has `succeeded`. Null for API keys, which get no task: wait on `scheduled_job_id` instead.","example":"bt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"scheduled_job_id":{"type":"string","description":"The cleanup chunk queued or running now (`sj_…`). Each chunk deletes 500 transactions and queues the next one; follow them with `GET /v1/scheduled-jobs?generate_job_id=`. The `generate_job.cleanup` audit row is written by the last chunk.","example":"sj_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},"required":["id","state","background_task_id","scheduled_job_id"]},"CancelGenerateJobResponseDto":{"type":"object","properties":{"id":{"type":"string","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"status":{"type":"string","enum":["pending","running","completed","failed","canceled"],"description":"`canceled` after a cancel; a job that had already finished keeps its status (`completed`, `failed` or `canceled`)."},"rows_done":{"type":"integer","minimum":0,"description":"Transactions the job committed (kept until `POST /v1/dev/generate-jobs/:id/cleanup`).","example":1500}},"required":["id","status","rows_done"]},"ResetAcceptedDto":{"type":"object","properties":{"id":{"type":"string","description":"The reset job queued or running now (`sj_…`). It deletes in batches of 1,000 rows per table; later batches may run under new job ids.","example":"sj_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"state":{"type":"string","enum":["queued","running"]},"background_task_id":{"type":"string","nullable":true,"description":"The `dev.reset` background task (`bt_…`) in `GET /v1/me/background-tasks`. When it has `succeeded`, `result.counts` holds `deleted` (all rows) and the per-table totals.","example":"bt_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}},"required":["id","state","background_task_id"]},"AdvanceLifecycleDto":{"type":"object","properties":{"as_of":{"type":"string","format":"date-time","description":"Evaluate deadlines as if it were this instant: not before now, at most 400 days ahead. E.g. now + 56 days rules every dispute under review. Default: now.","example":"2026-12-17T12:00:00.000Z"},"issuer_decision":{"type":"string","enum":["won","lost","random"],"description":"Verdict for disputes past the 55-day issuer review window. `random` is 60% won / 40% lost. Default `random`."},"dispute_ids":{"minItems":1,"maxItems":200,"description":"Evaluate only these disputes (display ids) of the caller's tenant, pinned or not. Unknown ids are ignored. Not together with `generate_job_id`.","example":["dsp_01J9Z3K4M5N6P7Q8R9S0T1V2W3"],"type":"array","items":{"type":"string"}},"generate_job_id":{"type":"string","description":"Evaluate only the disputes this generate job created (`gj_…`), pinned or not. 404 if it is not the caller's tenant's job. Not together with `dispute_ids`.","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3"}}},"AdvanceLifecycleResponseDto":{"type":"object","properties":{"rfi_expired":{"type":"number","minimum":0,"description":"This tenant's disputes moved rfi_open → rfi_expired.","example":0},"expired":{"type":"number","minimum":0,"description":"This tenant's disputes moved evidence_required → expired.","example":2},"ruled":{"type":"number","minimum":0,"description":"This tenant's disputes ruled won or lost after the issuer review window.","example":1},"escalated":{"type":"number","minimum":0,"description":"This tenant's disputes moved by an opt-in `lifecycle.escalation` transition (an expired or answered RFI, an arbitration ruling, an issuer cancel, a won reversal), every kind together. Only disputes whose own stamp sets the sub-key; 0 without one.","example":0},"as_of":{"type":"string","format":"date-time","description":"The instant deadlines were evaluated against."},"targeted":{"type":"integer","nullable":true,"description":"With `dispute_ids` or `generate_job_id`: how many of the targeted disputes exist in this tenant (and were evaluated). Null for an untargeted run.","example":5},"count":{"type":"integer","minimum":0,"description":"With `as_of`: how many lifecycle jobs (`dispute.deadline`, `dispute.rule`, `dispute.escalate`) of the evaluated `scheduled` disputes, due at or before `as_of`, were fast-forwarded to now. The scheduled-jobs runner applies them within seconds (wait on the `dispute.expire` / `dispute.rule` audit rows); scheduled disputes are never moved by the pass itself. 0 without `as_of`.","example":0}},"required":["rfi_expired","expired","ruled","escalated","as_of","targeted","count"]},"PendingActionDto":{"type":"object","properties":{"action":{"type":"string","enum":["challenge","arbitrate"],"description":"The acknowledged action."},"requested_at":{"type":"string","format":"date-time","description":"When the action was requested (and acknowledged with 202)."},"completes_at":{"type":"string","format":"date-time","description":"When it takes effect. A fast-forward of its job moves this earlier by the same amount."},"job_id":{"type":"string","description":"The `dispute.complete_action` scheduled job (`sj_…`): fast-forward or cancel it through `/v1/scheduled-jobs`.","example":"sj_01JA0Z3K4M5N6P7Q8R9S0T1V2W"},"evidence_count":{"type":"integer","description":"Challenge only: the evidence files the challenge counts, frozen when it was requested.","example":2}},"required":["action","requested_at","completes_at","job_id"]},"TransactionDto":{"type":"object","properties":{"id":{"type":"string","description":"Transaction id (`txn_…`).","example":"txn_J0GW02V0XP4PW8SCAWJQC3XH"},"tenant_id":{"type":"string","description":"Internal workspace id (UUID). Same on every record of the workspace.","format":"uuid"},"status":{"type":"string","enum":["authorized","captured","refunded","partially_refunded","voided","failed"]},"amount":{"type":"string","pattern":"^-?[0-9]+$","description":"Amount in minor units.","example":"1833"},"refunded_amount":{"type":"string","pattern":"^-?[0-9]+$","description":"Refunded so far, minor units.","example":"0"},"currency":{"type":"string","description":"ISO 4217 currency code.","example":"USD","minLength":3,"maxLength":3},"card_brand":{"type":"string","enum":["visa","mastercard","amex","discover","jcb"]},"card_last4":{"type":"string","example":"2470","pattern":"^[0-9]{4}$"},"mcc":{"type":"string","description":"Merchant category code.","example":"5651"},"merchant_name":{"type":"string","example":"Mott Street Bakery"},"customer_email":{"type":"string","nullable":true,"format":"email"},"customer_name":{"type":"string","nullable":true},"customer_ip":{"type":"string","nullable":true,"description":"Cardholder IP address."},"processor_reference":{"type":"string","description":"Processor charge reference.","example":"ch_Y1L5N54RC5ZWB6Y3AJ4SH4LC"},"billing_descriptor":{"type":"string","example":"MOTT STREET BAKERY"},"processing_channel":{"type":"string","example":"pc_high_risk"},"acquirer_reference":{"type":"string","description":"Acquirer reference number (ARN).","example":"52631148020597100836740"},"authorization_code":{"type":"string","example":"169837"},"response_code":{"type":"string","description":"Issuer response code (`00` = approved).","example":"00"},"card_holder_name":{"type":"string","example":"Jack McGurn"},"card_expiry_month":{"type":"string","example":"02","pattern":"^[0-9]{2}$"},"card_expiry_year":{"type":"string","example":"28","pattern":"^[0-9]{2}$"},"card_processing_scheme":{"type":"string","enum":["visa","mastercard","amex","discover","jcb"]},"issuing_country":{"type":"string","description":"ISO 3166-1 alpha-2 country of the issuer.","example":"US"},"issuing_bank":{"type":"string","example":"Citibank"},"cvv_check":{"type":"string","enum":["matched","not_matched","not_checked"]},"avs_check":{"type":"string","enum":["matched","not_matched","not_checked"]},"payment_type":{"type":"string","enum":["regular","recurring","installment","moto","unscheduled"]},"network_token_used":{"type":"boolean"},"is_aft":{"type":"boolean","description":"Account funding transaction."},"fingerprint":{"type":"string","description":"Stable card fingerprint.","example":"fp_visa_a3f738dqz0gfk1qek9ve"},"fee_breakdown":{"type":"object","description":"Fee components in minor units, keyed by fee name (`scheme`, `gateway`, `processing`, `interchange`).","additionalProperties":{"type":"string"},"example":{"scheme":"4","gateway":"20","processing":"6","interchange":"43"}},"metadata":{"type":"object","description":"Free-form synthetic attributes.","additionalProperties":true},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"}},"required":["id","tenant_id","status","amount","refunded_amount","currency","card_brand","card_last4","mcc","merchant_name","customer_email","customer_name","customer_ip","processor_reference","billing_descriptor","processing_channel","acquirer_reference","authorization_code","response_code","card_holder_name","card_expiry_month","card_expiry_year","card_processing_scheme","issuing_country","issuing_bank","cvv_check","avs_check","payment_type","network_token_used","is_aft","fingerprint","fee_breakdown","metadata","created_at","updated_at"]},"EvidenceDto":{"type":"object","properties":{"id":{"type":"string","description":"Evidence id (`evd_…`).","example":"evd_5HGX0Z3ZQ5QW1M8N7K6J4D2C9B"},"kind":{"type":"string","enum":["receipt","shipping_proof","communication","refund_policy","service_documentation","other"]},"filename":{"type":"string","example":"receipt.pdf"},"content_type":{"type":"string","example":"application/pdf"},"size_bytes":{"type":"string","pattern":"^[0-9]+$","description":"File size in bytes (integer string).","example":"48213"},"storage_key":{"type":"string","description":"Where the file is stored; pass nothing back, use the download-url endpoint."},"note":{"type":"string","nullable":true},"status":{"type":"string","enum":["processing","available","rejected"],"description":"`available`: counted by a challenge and downloadable. `processing`: waiting for processing under the `evidence.processing` flow variant (until `processing_until`). `rejected`: processing rejected it (`rejection_reason`) and the stored file was deleted. Always `available` without that variant.","example":"available"},"rejection_reason":{"type":"string","nullable":true,"enum":["virus_detected","unsupported_type","unreadable","processing_canceled","processing_failed"],"description":"Why a `rejected` file was rejected; null otherwise. `processing_canceled` / `processing_failed`: its processing job was canceled or failed for good."},"processing_until":{"type":"string","format":"date-time","nullable":true,"description":"When a `processing` file is settled (moved by a fast-forward of its `evidence.process` job); null otherwise."},"flow":{"type":"object","additionalProperties":true,"nullable":true,"description":"The flow snapshot stamped when the file was finalized (`{profile_id, version, source, variants}` with the concrete `evidence.processing`). Null for files attached before evidence variants.","example":{"profile_id":"fp_platform","version":null,"source":"platform","variants":{"evidence.processing":null}}},"created_at":{"type":"string","format":"date-time"}},"required":["id","kind","filename","content_type","size_bytes","storage_key","note","status","rejection_reason","processing_until","flow","created_at"]},"DisputeDto":{"type":"object","properties":{"id":{"type":"string","description":"Dispute id (`dsp_…`).","example":"dsp_H0FYBPH5WFNXBK7MBJ5EHDYK"},"network_case_id":{"type":"string","nullable":true,"description":"Scheme case id (Visa `VROL-…`, Mastercard `MC-…`).","example":"VROL-5942C5F0"},"tenant_id":{"type":"string","description":"Internal workspace id (UUID). Same on every record of the workspace.","format":"uuid"},"lifecycle_manual":{"type":"boolean","description":"True when the dispute is pinned: only an advance-lifecycle that names it moves it."},"lifecycle_mode":{"type":"string","enum":["auto","manual","scheduled"],"description":"`auto`: the hourly lifecycle pass expires and rules it. `manual`: pinned (also when `lifecycle_manual` is true, or after its scheduled lifecycle job was canceled); only an advance-lifecycle that names it moves it. `scheduled`: created under a flow profile with `lifecycle.windows` or `lifecycle.review`, so its deadline and ruling run as scheduled jobs (`GET /v1/scheduled-jobs?target_id=`); fast-forward them to move `respond_by` and the transition together."},"flow":{"type":"object","additionalProperties":true,"nullable":true,"description":"The flow snapshot stamped when generate created the dispute (`{profile_id, version, source, variants, generate_seed}` with the concrete `lifecycle.ruling`, `lifecycle.windows`, `lifecycle.review` and `lifecycle.webhooks`); its lifecycle reads only this, never the workspace default. Null for disputes created before lifecycle profiles (they behave as `fp_platform`).","example":{"profile_id":"fp_platform","version":null,"source":"platform","variants":{"lifecycle.ruling":{"mode":"random"},"lifecycle.windows":null,"lifecycle.review":null,"lifecycle.webhooks":{"enabled":false}},"generate_seed":7}},"pending_action":{"nullable":true,"description":"An action acknowledged under the `dispute.action_ack` flow variant that has not taken effect yet: `status` stays as it was until `completes_at`, and every other action on the dispute is 409 `action_pending` meanwhile. Null otherwise (always, without that variant).","type":"object","allOf":[{"$ref":"#/components/schemas/PendingActionDto"}]},"status":{"type":"string","enum":["rfi_open","rfi_responded","rfi_expired","evidence_required","under_review","won","lost","accepted","expired","canceled","resolved","arbitration_under_review","arbitration_won","arbitration_lost"]},"reason_code":{"type":"string","description":"Scheme reason code.","enum":["10.4","13.1","13.2","13.3","13.6","13.7","4853","4855","4863","4870"]},"category":{"type":"string","enum":["fraud","consumer","processing_error","authorization"]},"amount":{"type":"string","pattern":"^-?[0-9]+$","description":"Disputed amount, minor units.","example":"1833"},"dispute_fee":{"type":"string","pattern":"^-?[0-9]+$","description":"Scheme dispute fee, minor units.","example":"1500"},"arbitration_fee":{"type":"string","pattern":"^-?[0-9]+$","nullable":true,"description":"Arbitration fee, minor units; null unless escalated."},"currency":{"type":"string","example":"USD","minLength":3,"maxLength":3},"opened_at":{"type":"string","format":"date-time"},"respond_by":{"type":"string","format":"date-time","description":"Deadline for the next merchant action."},"resolved_at":{"type":"string","format":"date-time","nullable":true},"resolution_note":{"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"transaction":{"description":"The disputed transaction.","allOf":[{"$ref":"#/components/schemas/TransactionDto"}]},"evidence":{"description":"Evidence files. Present on single-dispute responses (not in lists); empty without `evidence.read`.","type":"array","items":{"$ref":"#/components/schemas/EvidenceDto"}}},"required":["id","network_case_id","tenant_id","lifecycle_manual","lifecycle_mode","flow","pending_action","status","reason_code","category","amount","dispute_fee","arbitration_fee","currency","opened_at","respond_by","resolved_at","resolution_note","created_at","updated_at","transaction"]},"DisputePageDto":{"type":"object","properties":{"items":{"description":"This page, newest opened first (no `evidence`).","type":"array","items":{"$ref":"#/components/schemas/DisputeDto"}},"total":{"type":"number","description":"Matching disputes in all pages.","example":42},"page":{"type":"number","example":1},"page_size":{"type":"number","example":50}},"required":["items","total","page","page_size"]},"TransactionSummaryDto":{"type":"object","properties":{"id":{"type":"string","description":"Transaction id (`txn_…`).","example":"txn_J0GW02V0XP4PW8SCAWJQC3XH"},"amount":{"type":"string","pattern":"^-?[0-9]+$","description":"Amount in minor units.","example":"1833"},"currency":{"type":"string","description":"ISO 4217 currency code.","example":"USD","minLength":3,"maxLength":3},"card_brand":{"type":"string","enum":["visa","mastercard","amex","discover","jcb"]},"card_last4":{"type":"string","example":"2470","pattern":"^[0-9]{4}$"},"merchant_name":{"type":"string","example":"Mott Street Bakery"},"processor_reference":{"type":"string","description":"Processor charge reference.","example":"ch_Y1L5N54RC5ZWB6Y3AJ4SH4LC"},"created_at":{"type":"string","format":"date-time"}},"required":["id","amount","currency","card_brand","card_last4","merchant_name","processor_reference","created_at"]},"DisputeSummaryDto":{"type":"object","properties":{"id":{"type":"string","description":"Dispute id (`dsp_…`).","example":"dsp_H0FYBPH5WFNXBK7MBJ5EHDYK"},"network_case_id":{"type":"string","nullable":true,"description":"Scheme case id (Visa `VROL-…`, Mastercard `MC-…`).","example":"VROL-5942C5F0"},"tenant_id":{"type":"string","description":"Internal workspace id (UUID). Same on every record of the workspace.","format":"uuid"},"lifecycle_manual":{"type":"boolean","description":"True when the dispute is pinned: only an advance-lifecycle that names it moves it."},"lifecycle_mode":{"type":"string","enum":["auto","manual","scheduled"],"description":"`auto`: the hourly lifecycle pass expires and rules it. `manual`: pinned (also when `lifecycle_manual` is true, or after its scheduled lifecycle job was canceled); only an advance-lifecycle that names it moves it. `scheduled`: created under a flow profile with `lifecycle.windows` or `lifecycle.review`, so its deadline and ruling run as scheduled jobs (`GET /v1/scheduled-jobs?target_id=`); fast-forward them to move `respond_by` and the transition together."},"flow":{"type":"object","additionalProperties":true,"nullable":true,"description":"The flow snapshot stamped when generate created the dispute (`{profile_id, version, source, variants, generate_seed}` with the concrete `lifecycle.ruling`, `lifecycle.windows`, `lifecycle.review` and `lifecycle.webhooks`); its lifecycle reads only this, never the workspace default. Null for disputes created before lifecycle profiles (they behave as `fp_platform`).","example":{"profile_id":"fp_platform","version":null,"source":"platform","variants":{"lifecycle.ruling":{"mode":"random"},"lifecycle.windows":null,"lifecycle.review":null,"lifecycle.webhooks":{"enabled":false}},"generate_seed":7}},"pending_action":{"nullable":true,"description":"An action acknowledged under the `dispute.action_ack` flow variant that has not taken effect yet: `status` stays as it was until `completes_at`, and every other action on the dispute is 409 `action_pending` meanwhile. Null otherwise (always, without that variant).","type":"object","allOf":[{"$ref":"#/components/schemas/PendingActionDto"}]},"status":{"type":"string","enum":["rfi_open","rfi_responded","rfi_expired","evidence_required","under_review","won","lost","accepted","expired","canceled","resolved","arbitration_under_review","arbitration_won","arbitration_lost"]},"reason_code":{"type":"string","description":"Scheme reason code.","enum":["10.4","13.1","13.2","13.3","13.6","13.7","4853","4855","4863","4870"]},"category":{"type":"string","enum":["fraud","consumer","processing_error","authorization"]},"amount":{"type":"string","pattern":"^-?[0-9]+$","description":"Disputed amount, minor units.","example":"1833"},"dispute_fee":{"type":"string","pattern":"^-?[0-9]+$","description":"Scheme dispute fee, minor units.","example":"1500"},"arbitration_fee":{"type":"string","pattern":"^-?[0-9]+$","nullable":true,"description":"Arbitration fee, minor units; null unless escalated."},"currency":{"type":"string","example":"USD","minLength":3,"maxLength":3},"opened_at":{"type":"string","format":"date-time"},"respond_by":{"type":"string","format":"date-time","description":"Deadline for the next merchant action."},"resolved_at":{"type":"string","format":"date-time","nullable":true},"resolution_note":{"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"transaction":{"description":"The disputed transaction, list fields only.","allOf":[{"$ref":"#/components/schemas/TransactionSummaryDto"}]}},"required":["id","network_case_id","tenant_id","lifecycle_manual","lifecycle_mode","flow","pending_action","status","reason_code","category","amount","dispute_fee","arbitration_fee","currency","opened_at","respond_by","resolved_at","resolution_note","created_at","updated_at","transaction"]},"DisputeSummaryPageDto":{"type":"object","properties":{"items":{"description":"This page, newest opened first.","type":"array","items":{"$ref":"#/components/schemas/DisputeSummaryDto"}},"total":{"type":"number","description":"Matching disputes in all pages.","example":42},"page":{"type":"number","example":1},"page_size":{"type":"number","example":50}},"required":["items","total","page","page_size"]},"BulkDecisionItem":{"type":"object","properties":{"dispute_id":{"type":"string","description":"Dispute id (`dsp_…`).","example":"dsp_H0FYBPH5WFNXBK7MBJ5EHDYK"},"action":{"type":"string","enum":["accept","challenge","escalate","note"],"description":"`escalate` files arbitration on a lost dispute; `note` adds a timeline note."},"note":{"type":"string","description":"Note for the timeline (the note text for `note`)."}},"required":["dispute_id","action"]},"BulkDecisionsDto":{"type":"object","properties":{"decisions":{"minItems":1,"type":"array","items":{"$ref":"#/components/schemas/BulkDecisionItem"}}},"required":["decisions"]},"BulkResultDto":{"type":"object","properties":{"dispute_id":{"type":"string","description":"The dispute id from the request item.","example":"dsp_H0FYBPH5WFNXBK7MBJ5EHDYK"},"ok":{"type":"boolean","description":"Whether this item was applied."},"action":{"type":"string","example":"accept"},"new_status":{"type":"string","enum":["rfi_open","rfi_responded","rfi_expired","evidence_required","under_review","won","lost","accepted","expired","canceled","resolved","arbitration_under_review","arbitration_won","arbitration_lost"],"description":"The dispute's status after the action, when it changed one."},"message":{"type":"string","description":"Why the item failed (only when `ok` is false).","example":"dispute not found"}},"required":["dispute_id","ok","action"]},"ApplyPlaybookResultDto":{"type":"object","properties":{"playbook_id":{"type":"string","description":"The playbook that ran (`pb_…`).","example":"pb_2YD01BM1E37RDKF3BBRNS64J"},"total_open":{"type":"number","description":"Open disputes evaluated (`evidence_required` and `rfi_open`)."},"matched":{"type":"number","description":"Disputes a rule matched (each gets one result)."},"no_match":{"type":"number","description":"Disputes no rule matched."},"results":{"description":"`auto_accept` matches are accepted; other actions add a timeline note.","type":"array","items":{"$ref":"#/components/schemas/BulkResultDto"}}},"required":["playbook_id","total_open","matched","no_match","results"]},"DisputeEventDto":{"type":"object","properties":{"id":{"type":"string","description":"Timeline event id (`evt_…`).","example":"evt_5303SFAXBE8ZPRP2PJB5SP2H"},"kind":{"type":"string","enum":["status_change","evidence_added","note","escalated","reversed"],"description":"`escalated` (an RFI escalated to a chargeback) and `reversed` (a win reversed in pre-arbitration) are status changes from `lifecycle.escalation`; their `metadata` is `{from, to}` like `status_change`."},"actor_sub":{"type":"string","description":"Who acted: a user id (the `sub` of their access token), `system`, or an API key id (`tak_…`).","example":"system"},"message":{"type":"string","example":"Dispute opened (4870)"},"metadata":{"type":"object","additionalProperties":true,"description":"Kind-specific details, e.g. `{from, to}` statuses for `status_change`.","example":{"from":null,"to":"evidence_required"}},"created_at":{"type":"string","format":"date-time"}},"required":["id","kind","actor_sub","message","metadata","created_at"]},"AddNoteDto":{"type":"object","properties":{"message":{"type":"string","minLength":1,"example":"Customer called; refund issued."}},"required":["message"]},"ResolveNoteDto":{"type":"object","properties":{"note":{"type":"string","description":"Optional note, kept as the resolution note and on the timeline."}}},"RfiResponseDto":{"type":"object","properties":{"response":{"type":"string","description":"Answer to the issuer's request for information.","minLength":1}},"required":["response"]},"UploadUrlDto":{"type":"object","properties":{"filename":{"type":"string","example":"receipt.pdf","minLength":1},"content_type":{"type":"string","example":"application/pdf","description":"MIME type the file will be uploaded with."}},"required":["filename","content_type"]},"EvidenceUploadUrlDto":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Presigned PUT URL: upload the file with the same `Content-Type`."},"storage_key":{"type":"string","description":"Pass back as `storage_key` to `POST /v1/disputes/{id}/evidence` after the upload."},"expires_at":{"type":"number","description":"When the URL stops working, in milliseconds since the Unix epoch.","example":1793117910628}},"required":["url","storage_key","expires_at"]},"FinalizeEvidenceDto":{"type":"object","properties":{"storage_key":{"type":"string","description":"`storage_key` from the upload-url response, after the PUT succeeded."},"filename":{"type":"string","example":"receipt.pdf"},"content_type":{"type":"string","example":"application/pdf"},"kind":{"type":"string","enum":["receipt","shipping_proof","communication","refund_policy","service_documentation","other"]},"note":{"type":"string"}},"required":["storage_key","filename","content_type","kind"]},"SignedDownloadUrlDto":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Presigned GET URL. Treat it as a secret until it expires."},"expires_at":{"type":"string","format":"date-time","description":"When the URL stops working (ISO 8601). Set by the `report.download_url` / `evidence.download_url` flow variants (default 300 s); in the past for `{mode: \"expired\"}`."},"filename":{"type":"string","description":"File name to save the download as.","example":"receipt.pdf"}},"required":["url","expires_at","filename"]},"RuleConditionDto":{"type":"object","properties":{"field":{"type":"string","enum":["amount_minor","reason_code","category","card_brand","mcc","currency","has_refund"]},"op":{"type":"string","enum":["eq","neq","in","not_in","lt","lte","gt","gte"],"description":"`in` / `not_in` take an array; `lt`…`gte` a number."},"value":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"array","items":{"oneOf":[{"type":"string"},{"type":"number"}]}}],"example":5000}},"required":["field","op","value"]},"RuleDto":{"type":"object","properties":{"id":{"type":"string","description":"Rule id (`rl_…`).","example":"rl_9QW2E3R4T5Y6U7I8O9P0A1S2D3"},"name":{"type":"string"},"priority":{"type":"number"},"enabled":{"type":"boolean"},"conditions":{"type":"array","items":{"$ref":"#/components/schemas/RuleConditionDto"}},"action":{"type":"string","enum":["auto_accept","auto_defend","manual_review"]},"note":{"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"}},"required":["id","name","priority","enabled","conditions","action","note","created_at"]},"PlaybookDto":{"type":"object","properties":{"id":{"type":"string","description":"Playbook id (`pb_…`).","example":"pb_2YD01BM1E37RDKF3BBRNS64J"},"tenant_id":{"type":"string","description":"Internal workspace id (UUID).","format":"uuid"},"name":{"type":"string"},"description":{"type":"string","nullable":true},"enabled":{"type":"boolean","description":"False once disabled, including when the API key that created it went inactive."},"is_default":{"type":"boolean"},"created_by_key_id":{"type":"string","nullable":true,"description":"The API key that created it (`tak_…`), or null when a user did. It stops running once that key expires or is revoked."},"key_expires_at":{"type":"string","format":"date-time","nullable":true,"description":"When that key expires."},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"rules":{"description":"Evaluated by `priority`, lowest first; the first match wins.","type":"array","items":{"$ref":"#/components/schemas/RuleDto"}}},"required":["id","tenant_id","name","description","enabled","is_default","created_by_key_id","key_expires_at","created_at","updated_at","rules"]},"RuleInput":{"type":"object","properties":{"name":{"type":"string","minLength":1,"example":"Small fraud claims"},"priority":{"type":"number","description":"Lower runs first. Default: 10 × the rule's 1-based position (10, 20, …)."},"enabled":{"type":"boolean","default":true},"conditions":{"description":"All must match (AND).","type":"array","items":{"$ref":"#/components/schemas/RuleConditionDto"}},"action":{"type":"string","enum":["auto_accept","auto_defend","manual_review"]},"note":{"type":"string","nullable":true,"description":"Shown on the timeline when the rule acts."}},"required":["name","conditions","action"]},"PlaybookInputDto":{"type":"object","properties":{"name":{"type":"string","minLength":1,"example":"Default triage"},"description":{"type":"string","nullable":true},"enabled":{"type":"boolean","default":true},"is_default":{"type":"boolean","default":false},"rules":{"description":"The full rule list (replaces the existing rules on update).","type":"array","items":{"$ref":"#/components/schemas/RuleInput"}}},"required":["name","rules"]},"DryRunCountsDto":{"type":"object","properties":{"auto_accept":{"type":"number"},"auto_defend":{"type":"number"},"manual_review":{"type":"number"},"no_match":{"type":"number"}},"required":["auto_accept","auto_defend","manual_review","no_match"]},"DryRunSampleDto":{"type":"object","properties":{"dispute_id":{"type":"string","description":"Dispute id (`dsp_…`)."},"action":{"type":"string","enum":["auto_accept","auto_defend","manual_review","no_match"]},"rule_name":{"type":"string","nullable":true,"description":"The rule that matched, or null."}},"required":["dispute_id","action","rule_name"]},"DryRunResultDto":{"type":"object","properties":{"counts":{"description":"How many of the workspace's disputes (every status) each action would match now.","allOf":[{"$ref":"#/components/schemas/DryRunCountsDto"}]},"samples":{"description":"Per-dispute outcomes for the first 50 disputes evaluated.","maxItems":50,"type":"array","items":{"$ref":"#/components/schemas/DryRunSampleDto"}}},"required":["counts","samples"]},"SubscriberFilterDto":{"type":"object","properties":{"correlation_prefix":{"type":"string","description":"Only events whose triggering request (or the job it started) carried an `X-Correlation-Id` starting with this. 1-128 characters of `A-Z a-z 0-9 . _ : / -`.","example":"run-036a","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9._:/-]{1,128}$"},"generate_job_id":{"type":"string","description":"Only events of this generate job (`gj_…`): its `dispute.created` webhooks and its disputes' lifecycle transitions.","example":"gj_01J9Z3K4M5N6P7Q8R9S0T1V2W3","pattern":"^gj_[0-9A-Za-z]{24}$"}}},"DeliveryVariantDto":{"type":"object","properties":{"delay_s":{"type":"number","description":"Seconds the delivery was held before release.","minimum":0,"maximum":86400},"duplicates":{"type":"number","description":"Copies sent with the same delivery id and body.","minimum":1,"maximum":3},"duplicate_gap_s":{"type":"number","description":"Seconds between copies.","minimum":0,"maximum":300},"signature":{"type":"string","enum":["valid","invalid","missing"],"description":"`invalid`: signed with a random key; `missing`: no `X-Dispute-Signature` header."},"fail_first_n":{"type":"number","description":"Attempts recorded as failed (`simulated_failure`) without sending.","minimum":0,"maximum":5},"drop":{"type":"boolean","description":"True: stored `failed` (`simulated_drop`), never sent."},"reorder_window_s":{"type":"number","description":"Seconds a dispute's deliveries were held to be released newest first.","minimum":0,"maximum":60}},"required":["delay_s","duplicates","duplicate_gap_s","signature","fail_first_n","drop","reorder_window_s"]},"RecentDeliveryDto":{"type":"object","properties":{"id":{"type":"string","description":"Delivery id (`whd_…`), the `X-Dispute-Delivery-Id` the receiver saw.","example":"whd_01J9Z3K4M5N6P7Q8R9S0T1V2W3"},"event":{"type":"string","example":"dispute.status_changed"},"status":{"type":"string","enum":["held","pending","succeeded","failed"],"description":"`held`: waiting for its release (`held_until`); `pending`: an attempt, retry or duplicate copy is due."},"attempt":{"type":"number","description":"Attempts made (simulated failures count; duplicate copies do not)."},"copies_sent":{"type":"number","description":"Copies delivered so far."},"sequence":{"type":"number","nullable":true,"description":"The `sequence` in the delivery body (monotonic across the platform; gaps expected)."},"error_code":{"type":"string","nullable":true,"description":"`simulated_failure`, `simulated_drop`, `delivery_backlog_full` or `release_canceled`; null otherwise."},"last_status_code":{"type":"number","nullable":true,"description":"HTTP status of the last attempt; null when none answered."},"variant":{"nullable":true,"description":"The variant applied; null for a normal delivery.","type":"object","allOf":[{"$ref":"#/components/schemas/DeliveryVariantDto"}]},"held_until":{"type":"string","format":"date-time","nullable":true,"description":"When a held delivery is released."},"next_attempt_at":{"type":"string","format":"date-time","nullable":true,"description":"When the next attempt or copy is due (pending only)."},"created_at":{"type":"string","format":"date-time"}},"required":["id","event","status","attempt","copies_sent","sequence","error_code","last_status_code","variant","held_until","next_attempt_at","created_at"]},"WebhookDto":{"type":"object","properties":{"id":{"type":"string","description":"Webhook id (`wh_…`).","example":"wh_3K7D1QW9ZB2M4X8N6P0R5T1V3C"},"tenant_id":{"type":"string","description":"Internal workspace id (UUID).","format":"uuid"},"url":{"type":"string","format":"uri","example":"https://example.com/hooks/dispute"},"events":{"type":"array","description":"Subscribed events; empty means all.","items":{"type":"string","enum":["dispute.created","dispute.status_changed","dispute.evidence_added","dispute.note_added","report.ready","evidence.processed"]}},"enabled":{"type":"boolean","description":"False when disabled by you, or because the API key that created it went inactive."},"last_attempted_at":{"type":"string","format":"date-time","nullable":true,"description":"Last delivery attempt."},"last_delivered_at":{"type":"string","format":"date-time","nullable":true,"description":"Last delivery answered with 2xx."},"last_error":{"type":"string","nullable":true,"description":"Why the last attempt failed, or null."},"accepts_simulation":{"type":"boolean","description":"A simulation subscriber: gets the opt-in event types (`report.ready`, `evidence.processed`, lifecycle `dispute.status_changed`, `dispute.created` after generate) and the `webhook.delivery` flow variant. Defaults to true for a dev webhook sink URL, else false."},"filter":{"nullable":true,"description":"Run scope; null receives every event.","type":"object","allOf":[{"$ref":"#/components/schemas/SubscriberFilterDto"}]},"recent_deliveries":{"description":"The last 5 deliveries, newest first, with the variant applied to each. Empty on create and update.","type":"array","items":{"$ref":"#/components/schemas/RecentDeliveryDto"}},"created_by_key_id":{"type":"string","nullable":true,"description":"The API key that created it (`tak_…`), or null when a user did. Deliveries stop and the webhook is disabled once that key expires or is revoked."},"key_expires_at":{"type":"string","format":"date-time","nullable":true,"description":"When that key expires."},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"}},"required":["id","tenant_id","url","events","enabled","last_attempted_at","last_delivered_at","last_error","accepts_simulation","filter","recent_deliveries","created_by_key_id","key_expires_at","created_at","updated_at"]},"CreateWebhookDto":{"type":"object","properties":{"url":{"type":"string","format":"uri","example":"https://example.com/hooks/dispute","description":"Receiver URL. Must be https (http is accepted only outside production) and must resolve only to public addresses: private, loopback, link-local, cloud-metadata, CGNAT, unique-local IPv6 and `.local`/`.internal` hosts are rejected with 400 `webhook_url_not_allowed`. On `api.dispute.markets` itself only the URL of one of your live dev webhook sinks (`POST /v1/dev/webhook-sinks`) is accepted. Deliveries re-check DNS, never follow redirects (a 3xx counts as a failure) and time out after 10 s."},"events":{"type":"array","description":"Subscribed events; empty or omitted means all. Dispute actions through the API or the portal send `dispute.status_changed`, `dispute.evidence_added` and `dispute.note_added` to every subscribed webhook; `POST /v1/webhooks/{id}/test` sends `dispute.created`. Generated disputes (`dispute.created`), lifecycle steps, `report.ready` and `evidence.processed` are sent only to simulation subscribers (`accepts_simulation`) when a flow profile turns them on. The payloads and the delivery rules are in the `x-webhooks` section of this document.","items":{"type":"string","enum":["dispute.created","dispute.status_changed","dispute.evidence_added","dispute.note_added","report.ready","evidence.processed"]}},"accepts_simulation":{"type":"boolean","description":"Make this webhook a simulation subscriber (docs: Webhooks > Simulation subscribers): it gets the opt-in event types and the `webhook.delivery` flow variant. Default: true when `url` is one of your dev webhook sinks, false otherwise. Your real receivers should leave it false."},"filter":{"nullable":true,"description":"Run scope: only events whose triggering correlation id or generate job matches. Omit or null for every event.","type":"object","allOf":[{"$ref":"#/components/schemas/SubscriberFilterDto"}]}},"required":["url"]},"WebhookWithSecretDto":{"type":"object","properties":{"id":{"type":"string","description":"Webhook id (`wh_…`).","example":"wh_3K7D1QW9ZB2M4X8N6P0R5T1V3C"},"tenant_id":{"type":"string","description":"Internal workspace id (UUID).","format":"uuid"},"url":{"type":"string","format":"uri","example":"https://example.com/hooks/dispute"},"events":{"type":"array","description":"Subscribed events; empty means all.","items":{"type":"string","enum":["dispute.created","dispute.status_changed","dispute.evidence_added","dispute.note_added","report.ready","evidence.processed"]}},"enabled":{"type":"boolean","description":"False when disabled by you, or because the API key that created it went inactive."},"last_attempted_at":{"type":"string","format":"date-time","nullable":true,"description":"Last delivery attempt."},"last_delivered_at":{"type":"string","format":"date-time","nullable":true,"description":"Last delivery answered with 2xx."},"last_error":{"type":"string","nullable":true,"description":"Why the last attempt failed, or null."},"accepts_simulation":{"type":"boolean","description":"A simulation subscriber: gets the opt-in event types (`report.ready`, `evidence.processed`, lifecycle `dispute.status_changed`, `dispute.created` after generate) and the `webhook.delivery` flow variant. Defaults to true for a dev webhook sink URL, else false."},"filter":{"nullable":true,"description":"Run scope; null receives every event.","type":"object","allOf":[{"$ref":"#/components/schemas/SubscriberFilterDto"}]},"recent_deliveries":{"description":"The last 5 deliveries, newest first, with the variant applied to each. Empty on create and update.","type":"array","items":{"$ref":"#/components/schemas/RecentDeliveryDto"}},"created_by_key_id":{"type":"string","nullable":true,"description":"The API key that created it (`tak_…`), or null when a user did. Deliveries stop and the webhook is disabled once that key expires or is revoked."},"key_expires_at":{"type":"string","format":"date-time","nullable":true,"description":"When that key expires."},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"secret":{"type":"string","description":"The signing secret (`whsec_…`), returned ONLY in this response. Store it now: it is never shown again, and a retry with the same Idempotency-Key answers 409 `idempotency_secret_not_replayable` instead of replaying it.","example":"whsec_EXAMPLE"}},"required":["id","tenant_id","url","events","enabled","last_attempted_at","last_delivered_at","last_error","accepts_simulation","filter","recent_deliveries","created_by_key_id","key_expires_at","created_at","updated_at","secret"]},"UpdateWebhookDto":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Receiver URL. Must be https (http is accepted only outside production) and must resolve only to public addresses: private, loopback, link-local, cloud-metadata, CGNAT, unique-local IPv6 and `.local`/`.internal` hosts are rejected with 400 `webhook_url_not_allowed`. On `api.dispute.markets` itself only the URL of one of your live dev webhook sinks (`POST /v1/dev/webhook-sinks`) is accepted. Deliveries re-check DNS, never follow redirects (a 3xx counts as a failure) and time out after 10 s."},"events":{"type":"array","description":"Replaces the subscribed events; empty means all.","items":{"type":"string","enum":["dispute.created","dispute.status_changed","dispute.evidence_added","dispute.note_added","report.ready","evidence.processed"]}},"enabled":{"type":"boolean"},"accepts_simulation":{"type":"boolean","description":"Whether this webhook is a simulation subscriber."},"filter":{"nullable":true,"description":"Replaces the run scope; null removes it.","type":"object","allOf":[{"$ref":"#/components/schemas/SubscriberFilterDto"}]}}},"TestWebhookDto":{"type":"object","properties":{"payload":{"type":"string","description":"Free text echoed in the test event payload."}},"required":["payload"]},"TestWebhookResponseDto":{"type":"object","properties":{"ok":{"type":"boolean","description":"True when the endpoint answered 2xx."},"status_code":{"type":"number","nullable":true,"description":"HTTP status the endpoint answered; null when no response arrived."}},"required":["ok"]},"CreateWebhookSinkDto":{"type":"object","properties":{"filter":{"nullable":true,"description":"Scope the sink to one run (dispute-api/036): it receives only events whose triggering `X-Correlation-Id` starts with `correlation_prefix` and/or that belong to generate job `generate_job_id`, so another run's deliveries never reach it. Omit for every event.","type":"object","allOf":[{"$ref":"#/components/schemas/SubscriberFilterDto"}]}}},"WebhookSinkDto":{"type":"object","properties":{"id":{"type":"string","description":"The sink id (`whs_…`).","example":"whs_01J9Z3K4M5N6P7Q8R9S0T1V2W3","pattern":"^whs_[0-9A-Z]{24}$"},"url":{"type":"string","format":"uri","description":"Use this as a webhook URL (`POST /v1/webhooks`). Every delivery it receives is recorded in your audit trail as `webhook_sink.receive`.","example":"https://api.dispute.markets/v1/dev/webhook-sinks/whs_01J9Z3K4M5N6P7Q8R9S0T1V2W3/receive"},"expires_at":{"type":"string","format":"date-time","description":"The sink accepts deliveries until then (24 h after creation)."},"filter":{"nullable":true,"description":"Run scope: deliveries to this sink are made only for events whose triggering correlation id or generate job matches; null receives every event.","type":"object","allOf":[{"$ref":"#/components/schemas/SubscriberFilterDto"}]}},"required":["id","url","expires_at","filter"]},"SinkReceivedDto":{"type":"object","properties":{"received":{"type":"boolean","enum":[true]}},"required":["received"]},"TransactionPageDto":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/TransactionDto"}},"total":{"type":"number","description":"Matching transactions in all pages.","example":120},"page":{"type":"number","example":1},"page_size":{"type":"number","example":50}},"required":["items","total","page","page_size"]},"PaymentDisputeDto":{"type":"object","properties":{"id":{"type":"string","description":"Dispute id (`dsp_…`).","example":"dsp_H0FYBPH5WFNXBK7MBJ5EHDYK"},"network_case_id":{"type":"string","nullable":true,"description":"Scheme case id (Visa `VROL-…`, Mastercard `MC-…`).","example":"VROL-5942C5F0"},"tenant_id":{"type":"string","description":"Internal workspace id (UUID). Same on every record of the workspace.","format":"uuid"},"lifecycle_manual":{"type":"boolean","description":"True when the dispute is pinned: only an advance-lifecycle that names it moves it."},"lifecycle_mode":{"type":"string","enum":["auto","manual","scheduled"],"description":"`auto`: the hourly lifecycle pass expires and rules it. `manual`: pinned (also when `lifecycle_manual` is true, or after its scheduled lifecycle job was canceled); only an advance-lifecycle that names it moves it. `scheduled`: created under a flow profile with `lifecycle.windows` or `lifecycle.review`, so its deadline and ruling run as scheduled jobs (`GET /v1/scheduled-jobs?target_id=`); fast-forward them to move `respond_by` and the transition together."},"flow":{"type":"object","additionalProperties":true,"nullable":true,"description":"The flow snapshot stamped when generate created the dispute (`{profile_id, version, source, variants, generate_seed}` with the concrete `lifecycle.ruling`, `lifecycle.windows`, `lifecycle.review` and `lifecycle.webhooks`); its lifecycle reads only this, never the workspace default. Null for disputes created before lifecycle profiles (they behave as `fp_platform`).","example":{"profile_id":"fp_platform","version":null,"source":"platform","variants":{"lifecycle.ruling":{"mode":"random"},"lifecycle.windows":null,"lifecycle.review":null,"lifecycle.webhooks":{"enabled":false}},"generate_seed":7}},"pending_action":{"nullable":true,"description":"An action acknowledged under the `dispute.action_ack` flow variant that has not taken effect yet: `status` stays as it was until `completes_at`, and every other action on the dispute is 409 `action_pending` meanwhile. Null otherwise (always, without that variant).","type":"object","allOf":[{"$ref":"#/components/schemas/PendingActionDto"}]},"status":{"type":"string","enum":["rfi_open","rfi_responded","rfi_expired","evidence_required","under_review","won","lost","accepted","expired","canceled","resolved","arbitration_under_review","arbitration_won","arbitration_lost"]},"reason_code":{"type":"string","description":"Scheme reason code.","enum":["10.4","13.1","13.2","13.3","13.6","13.7","4853","4855","4863","4870"]},"category":{"type":"string","enum":["fraud","consumer","processing_error","authorization"]},"amount":{"type":"string","pattern":"^-?[0-9]+$","description":"Disputed amount, minor units.","example":"1833"},"dispute_fee":{"type":"string","pattern":"^-?[0-9]+$","description":"Scheme dispute fee, minor units.","example":"1500"},"arbitration_fee":{"type":"string","pattern":"^-?[0-9]+$","nullable":true,"description":"Arbitration fee, minor units; null unless escalated."},"currency":{"type":"string","example":"USD","minLength":3,"maxLength":3},"opened_at":{"type":"string","format":"date-time"},"respond_by":{"type":"string","format":"date-time","description":"Deadline for the next merchant action."},"resolved_at":{"type":"string","format":"date-time","nullable":true},"resolution_note":{"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"evidence":{"description":"Evidence files. Present on single-dispute responses (not in lists); empty without `evidence.read`.","type":"array","items":{"$ref":"#/components/schemas/EvidenceDto"}},"transaction":{"description":"Present when the payment was looked up by dispute id.","allOf":[{"$ref":"#/components/schemas/TransactionDto"}]}},"required":["id","network_case_id","tenant_id","lifecycle_manual","lifecycle_mode","flow","pending_action","status","reason_code","category","amount","dispute_fee","arbitration_fee","currency","opened_at","respond_by","resolved_at","resolution_note","created_at","updated_at"]},"PaymentEventDto":{"type":"object","properties":{"id":{"type":"string","description":"Payment event id (`pe_…`).","example":"pe_AKK3XYRD788JB8JQ08FGZRCZ"},"tenant_id":{"type":"string","description":"Internal workspace id (UUID).","format":"uuid"},"kind":{"type":"string","enum":["authorization","authorization_declined","fraud_detection_accept","fraud_detection_capture","fraud_detection_decline","capture","void","refund_initiated","refund_succeeded","refund_failed","partial_refund","paid_out","dispute_opened","dispute_evidence_required","dispute_evidence_submitted","dispute_won","dispute_lost","dispute_accepted","dispute_canceled","dispute_expired","arbitration_filed","arbitration_won","arbitration_lost","chargeback_reversed","chargeback_reopened","rfi_opened","rfi_responded","rfi_expired"]},"summary":{"type":"string","example":"Dispute opened"},"details":{"type":"object","additionalProperties":true,"description":"Kind-specific details (amounts in minor units as strings)."},"occurred_at":{"type":"string","format":"date-time","description":"When it happened in the simulated payment's life."},"created_at":{"type":"string","format":"date-time"}},"required":["id","tenant_id","kind","summary","details","occurred_at","created_at"]},"PaymentDetailDto":{"type":"object","properties":{"transaction":{"$ref":"#/components/schemas/TransactionDto"},"dispute":{"nullable":true,"description":"The transaction's dispute with its evidence (empty without `evidence.read`), or null.","type":"object","allOf":[{"$ref":"#/components/schemas/PaymentDisputeDto"}]},"events":{"description":"The payment's event history, newest first.","type":"array","items":{"$ref":"#/components/schemas/PaymentEventDto"}}},"required":["transaction","dispute","events"]},"ReportLimitOldestDto":{"type":"object","properties":{"id":{"type":"string","example":"rpt_QPTA0YAC7TDT82KPZ9VK4P85"},"name":{"type":"string","example":"October disputes"},"status":{"type":"string","enum":["queued","running","done","failed"]},"created_at":{"type":"string","format":"date-time"}},"required":["id","name","status","created_at"]},"ReportLimitReachedDetailsDto":{"type":"object","properties":{"limit":{"type":"integer","minimum":1,"maximum":100,"description":"`report.limits.max_live`.","example":3},"live_count":{"type":"integer","description":"Live reports of the run now.","example":3},"scope":{"type":"string","enum":["run"],"description":"What is counted: the caller's run (`run_key`)."},"run_key":{"type":"string","example":"run_8f2"},"counted_statuses":{"example":["queued","running","done","failed"],"type":"array","items":{"type":"string"}},"oldest":{"description":"Up to 5 of the run's live reports, oldest first: delete one, then retry.","type":"array","items":{"$ref":"#/components/schemas/ReportLimitOldestDto"}},"delete":{"type":"string","example":"DELETE /v1/reports/{id}"},"list":{"type":"string","description":"The run's live reports, oldest first (also the `Link: rel=\"oldest-deletable\"` header).","example":"/v1/reports?run_key=run_8f2&order=created_asc&limit=5"}},"required":["limit","live_count","scope","run_key","counted_statuses","oldest","delete","list"]},"ReportDeletedDetailsDto":{"type":"object","properties":{"id":{"type":"string","example":"rpt_QPTA0YAC7TDT82KPZ9VK4P85"},"deleted_at":{"type":"string","format":"date-time"},"deleted_by":{"type":"string","nullable":true,"description":"Who deleted it: a member's id or an API key (`tak_…`)."}},"required":["id","deleted_at","deleted_by"]},"ReportDto":{"type":"object","properties":{"id":{"type":"string","description":"Report id (`rpt_…`).","example":"rpt_QPTA0YAC7TDT82KPZ9VK4P85"},"tenant_id":{"type":"string","description":"Internal workspace id (UUID).","format":"uuid"},"name":{"type":"string","example":"October disputes"},"kind":{"type":"string","enum":["transactions","disputes"]},"status":{"type":"string","enum":["queued","running","done","failed","expired"],"description":"`running` while the CSV builds; download it once `done`. `queued` only under an async `report.delivery` flow variant (until `ready_at`). `expired`: older than 90 days, its file is deleted (download-url answers 410 `report_expired`)."},"filters":{"type":"object","additionalProperties":true,"description":"The filters it was created with (`from_date`, `to_date`).","example":{"from_date":"2026-10-01T00:00:00.000Z"}},"row_count":{"type":"number","description":"Rows in the CSV (0 until done)."},"storage_key":{"type":"string","nullable":true,"description":"Where the CSV is stored; use the download-url endpoint to fetch it."},"error_message":{"type":"string","nullable":true,"description":"Why it failed (status `failed`)."},"created_at":{"type":"string","format":"date-time"},"completed_at":{"type":"string","format":"date-time","nullable":true},"flow":{"type":"object","additionalProperties":true,"nullable":true,"description":"The flow snapshot stamped when the report was created (`{profile_id, version, source, variants}` with the concrete `report.delivery` and `report.outcome`); later work reads only this. Null for reports created before flow variants existed (they behave as `fp_platform`).","example":{"profile_id":"fp_platform","version":null,"source":"platform","variants":{"report.delivery":{"mode":"sync"},"report.outcome":{"mode":"ok"}}}},"ready_at":{"type":"string","format":"date-time","nullable":true,"description":"Async reports: when the queue delay ends (a fast-forward moves it earlier). Null for synchronous reports."},"progress_pct":{"type":"number","nullable":true,"minimum":0,"maximum":100,"description":"0 while `queued`; during a simulated build (`build_s`) the elapsed share in steps of 10 (at most 90); 100 once `done`; null otherwise. Derived from time on every read."},"truncated":{"type":"boolean","description":"The CSV was cut at `report.outcome.row_limit` rows."},"error_code":{"type":"string","nullable":true,"description":"Why it failed (`report_too_large`, `report_build_failed`, `report_timeout`, `internal`, `canceled`, `job_lease_expired`).","example":"report_timeout"},"simulated_failure":{"type":"boolean","description":"True when the failure was simulated by the `report.outcome` flow variant (`mode: fail` or `fail_then_ok`): `error_code` is the code the variant chose, `error_message` says it was simulated, and the audit row records `simulated_<error_code>`. False for real failures and every other status.","example":false},"attempt":{"type":"number","minimum":1,"description":"Build attempt: 1, plus one per `POST /v1/reports/{id}/retry`."},"fast_forwarded_by":{"type":"string","nullable":true,"description":"How far fast-forwards moved this report's timeline, as an ISO 8601 duration.","example":"PT2H59M50S"},"run_key":{"type":"string","description":"The run the report belongs to: the part of the creating request's `X-Correlation-Id` before the first `:`, or `default` without one. `report.limits` counts live reports per run; filter the list with `?run_key=`.","example":"run_8f2"}},"required":["id","tenant_id","name","kind","status","filters","row_count","storage_key","error_message","created_at","completed_at","flow","ready_at","progress_pct","truncated","error_code","simulated_failure","attempt","fast_forwarded_by","run_key"]},"CreateReportDto":{"type":"object","properties":{"name":{"type":"string","minLength":1,"example":"October disputes"},"kind":{"type":"string","enum":["transactions","disputes"]},"from_date":{"type":"string","format":"date-time","description":"Lower bound, inclusive: disputes by `opened_at`; transactions by `created_at` (applied only together with `to_date`)."},"to_date":{"type":"string","format":"date-time","description":"Upper bound, inclusive: disputes by `opened_at`; transactions by `created_at` (applied only together with `from_date`)."}},"required":["name","kind"]},"CreatedReportDto":{"type":"object","properties":{"id":{"type":"string","description":"Report id (`rpt_…`).","example":"rpt_QPTA0YAC7TDT82KPZ9VK4P85"},"tenant_id":{"type":"string","description":"Internal workspace id (UUID).","format":"uuid"},"name":{"type":"string","example":"October disputes"},"kind":{"type":"string","enum":["transactions","disputes"]},"status":{"type":"string","enum":["queued","running","done","failed","expired"],"description":"`running` while the CSV builds; download it once `done`. `queued` only under an async `report.delivery` flow variant (until `ready_at`). `expired`: older than 90 days, its file is deleted (download-url answers 410 `report_expired`)."},"filters":{"type":"object","additionalProperties":true,"description":"The filters it was created with (`from_date`, `to_date`).","example":{"from_date":"2026-10-01T00:00:00.000Z"}},"row_count":{"type":"number","description":"Rows in the CSV (0 until done)."},"storage_key":{"type":"string","nullable":true,"description":"Where the CSV is stored; use the download-url endpoint to fetch it."},"error_message":{"type":"string","nullable":true,"description":"Why it failed (status `failed`)."},"created_at":{"type":"string","format":"date-time"},"completed_at":{"type":"string","format":"date-time","nullable":true},"flow":{"type":"object","additionalProperties":true,"nullable":true,"description":"The flow snapshot stamped when the report was created (`{profile_id, version, source, variants}` with the concrete `report.delivery` and `report.outcome`); later work reads only this. Null for reports created before flow variants existed (they behave as `fp_platform`).","example":{"profile_id":"fp_platform","version":null,"source":"platform","variants":{"report.delivery":{"mode":"sync"},"report.outcome":{"mode":"ok"}}}},"ready_at":{"type":"string","format":"date-time","nullable":true,"description":"Async reports: when the queue delay ends (a fast-forward moves it earlier). Null for synchronous reports."},"progress_pct":{"type":"number","nullable":true,"minimum":0,"maximum":100,"description":"0 while `queued`; during a simulated build (`build_s`) the elapsed share in steps of 10 (at most 90); 100 once `done`; null otherwise. Derived from time on every read."},"truncated":{"type":"boolean","description":"The CSV was cut at `report.outcome.row_limit` rows."},"error_code":{"type":"string","nullable":true,"description":"Why it failed (`report_too_large`, `report_build_failed`, `report_timeout`, `internal`, `canceled`, `job_lease_expired`).","example":"report_timeout"},"simulated_failure":{"type":"boolean","description":"True when the failure was simulated by the `report.outcome` flow variant (`mode: fail` or `fail_then_ok`): `error_code` is the code the variant chose, `error_message` says it was simulated, and the audit row records `simulated_<error_code>`. False for real failures and every other status.","example":false},"attempt":{"type":"number","minimum":1,"description":"Build attempt: 1, plus one per `POST /v1/reports/{id}/retry`."},"fast_forwarded_by":{"type":"string","nullable":true,"description":"How far fast-forwards moved this report's timeline, as an ISO 8601 duration.","example":"PT2H59M50S"},"run_key":{"type":"string","description":"The run the report belongs to: the part of the creating request's `X-Correlation-Id` before the first `:`, or `default` without one. `report.limits` counts live reports per run; filter the list with `?run_key=`.","example":"run_8f2"},"background_task_id":{"type":"string","nullable":true,"description":"The `bt_…` background task that follows an async build for the signed-in creator (`GET /v1/me/background-tasks`); null for synchronous reports and API-key callers.","example":null}},"required":["id","tenant_id","name","kind","status","filters","row_count","storage_key","error_message","created_at","completed_at","flow","ready_at","progress_pct","truncated","error_code","simulated_failure","attempt","fast_forwarded_by","run_key","background_task_id"]},"ReportTombstoneDto":{"type":"object","properties":{"id":{"type":"string","description":"The deleted report (`rpt_…`).","example":"rpt_QPTA0YAC7TDT82KPZ9VK4P85"},"object":{"type":"string","enum":["report"]},"deleted":{"type":"boolean","enum":[true]},"deleted_at":{"type":"string","format":"date-time","description":"When the report was deleted (the first delete)."},"status_at_delete":{"type":"string","enum":["queued","running","done","failed","expired"],"description":"The status the report had when it was deleted."},"canceled_job_id":{"type":"string","nullable":true,"description":"The `sj_…` `report.build` job the delete canceled (a queued async report); null when there was none.","example":null},"already_deleted":{"type":"boolean","description":"True when the report was already deleted (a repeat call changed nothing)."}},"required":["id","object","deleted","deleted_at","status_at_delete","canceled_job_id","already_deleted"]},"MetricsRangeDto":{"type":"object","properties":{"from":{"type":"string","format":"date-time","description":"Start of the window: the `from` query, by default 30 days before `to`."},"to":{"type":"string","format":"date-time","description":"End of the window: the `to` query, by default now."}},"required":["from","to"]},"MetricsTotalsDto":{"type":"object","properties":{"transactions":{"type":"number"},"disputes":{"type":"number"},"transaction_volume_minor":{"type":"string","pattern":"^-?[0-9]+$","description":"Minor units (all currencies summed as-is)."},"dispute_volume_minor":{"type":"string","pattern":"^-?[0-9]+$"},"fees_paid_minor":{"type":"string","pattern":"^-?[0-9]+$"},"balance_minor":{"type":"string","pattern":"^-?[0-9]+$"},"refunded_minor":{"type":"string","pattern":"^-?[0-9]+$"},"lost_disputes_minor":{"type":"string","pattern":"^-?[0-9]+$"}},"required":["transactions","disputes","transaction_volume_minor","dispute_volume_minor","fees_paid_minor","balance_minor","refunded_minor","lost_disputes_minor"]},"KpiTileDto":{"type":"object","properties":{"value":{"type":"number","description":"The KPI value (a ratio from 0 to 1, or hours for `avg_time_to_respond_hours`)."},"numerator":{"type":"number","description":"Numerator of the ratio."},"denominator":{"type":"number","description":"Denominator of the ratio."}},"required":["value"]},"MetricsKpisDto":{"type":"object","properties":{"chargeback_ratio":{"$ref":"#/components/schemas/KpiTileDto"},"win_rate":{"$ref":"#/components/schemas/KpiTileDto"},"recovery_rate":{"$ref":"#/components/schemas/KpiTileDto"},"response_rate":{"$ref":"#/components/schemas/KpiTileDto"},"avg_time_to_respond_hours":{"$ref":"#/components/schemas/KpiTileDto"}},"required":["chargeback_ratio","win_rate","recovery_rate","response_rate","avg_time_to_respond_hours"]},"StatusCountDto":{"type":"object","properties":{"status":{"type":"string","enum":["rfi_open","rfi_responded","rfi_expired","evidence_required","under_review","won","lost","accepted","expired","canceled","resolved","arbitration_under_review","arbitration_won","arbitration_lost"]},"count":{"type":"number"}},"required":["status","count"]},"ReasonCodeCountDto":{"type":"object","properties":{"reason_code":{"type":"string","example":"10.4"},"category":{"type":"string","example":"fraud"},"count":{"type":"number"},"won":{"type":"number"},"lost":{"type":"number"}},"required":["reason_code","category","count","won","lost"]},"SchemeCountDto":{"type":"object","properties":{"scheme":{"type":"string","example":"visa"},"disputes":{"type":"number"},"transactions":{"type":"number"}},"required":["scheme","disputes","transactions"]},"SeriesPointDto":{"type":"object","properties":{"date":{"type":"string","format":"date","example":"2026-10-27"},"transactions":{"type":"number"},"disputes":{"type":"number"},"won":{"type":"number"},"lost":{"type":"number"}},"required":["date","transactions","disputes","won","lost"]},"MetricsSeriesDto":{"type":"object","properties":{"days":{"type":"number","example":30},"points":{"description":"One point per day, oldest first.","type":"array","items":{"$ref":"#/components/schemas/SeriesPointDto"}}},"required":["days","points"]},"MetricsOverviewDto":{"type":"object","properties":{"range":{"$ref":"#/components/schemas/MetricsRangeDto"},"totals":{"$ref":"#/components/schemas/MetricsTotalsDto"},"kpis":{"$ref":"#/components/schemas/MetricsKpisDto"},"by_status":{"type":"array","items":{"$ref":"#/components/schemas/StatusCountDto"}},"by_reason_code":{"type":"array","items":{"$ref":"#/components/schemas/ReasonCodeCountDto"}},"by_scheme":{"type":"array","items":{"$ref":"#/components/schemas/SchemeCountDto"}},"series":{"$ref":"#/components/schemas/MetricsSeriesDto"}},"required":["range","totals","kpis","by_status","by_reason_code","by_scheme","series"]},"UpdateWorkspaceSettingsDto":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80,"description":"Renames the workspace (trimmed; cannot be null)."},"company":{"type":"string","nullable":true,"maxLength":120,"description":"Company or organisation (trimmed); null or empty clears it."},"default_currency":{"type":"string","nullable":true,"pattern":"^[A-Z]{3}$","example":"EUR","description":"ISO 4217 code in upper case; null clears it."},"default_time_zone":{"type":"string","nullable":true,"example":"Europe/Lisbon","description":"IANA time zone; null clears it (UTC)."},"environment_label":{"type":"string","nullable":true,"minLength":1,"maxLength":24,"example":"QA-SANDBOX","description":"Environment label (trimmed); null or empty clears it."},"environment_color":{"type":"string","nullable":true,"pattern":"^#[0-9a-fA-F]{6}$","example":"#d97706","description":"`#rrggbb` (stored lower case); null clears it."}}},"UpdateUserPreferencesDto":{"type":"object","properties":{"time_zone":{"type":"string","nullable":true,"example":"Europe/Lisbon","description":"IANA time zone; null = follow the workspace."},"locale":{"type":"string","nullable":true,"enum":["en","pt","he","no","nn","ro"],"description":"One of the portal languages; null clears it."},"date_format":{"type":"string","enum":["locale","iso"]},"hour_cycle":{"type":"string","nullable":true,"enum":["h12","h23"],"description":"null = the language default."},"page_size":{"type":"integer","enum":[25,50,100,200]},"disputes_default_tab":{"type":"string","enum":["unanswered","all"]},"theme":{"type":"string","enum":["light","dark","system"]}}},"WebhookDisputeEventData":{"type":"object","description":"A dispute action or lifecycle step. `metadata` depends on the event (`{from, to}` for a status change).","required":["dispute_id","status","message","metadata","actor_sub","created_at"],"properties":{"dispute_id":{"type":"string","example":"dsp_A4K4P6R80Q5K7GK81Q7SK5G1"},"status":{"type":"string","description":"The dispute status after the event.","example":"under_review"},"message":{"type":"string","example":"Challenged with 2 evidence files."},"metadata":{"type":"object","additionalProperties":true},"actor_sub":{"type":"string","description":"Who acted: a user sub, `key:tak_…`, or `system`."},"created_at":{"type":"string","format":"date-time"}}},"WebhookGeneratedDisputeData":{"type":"object","description":"A dispute a generate job created (simulation subscribers only, under `lifecycle.webhooks`).","required":["dispute_id","status","reason_code","amount","currency","generate_job_id"],"properties":{"dispute_id":{"type":"string","example":"dsp_A4K4P6R80Q5K7GK81Q7SK5G1"},"status":{"type":"string","example":"evidence_required"},"reason_code":{"type":"string","example":"10.4"},"amount":{"type":"string","description":"Minor units, as a decimal string.","example":"4999"},"currency":{"type":"string","example":"USD"},"opened_at":{"type":"string","format":"date-time"},"respond_by":{"type":"string","format":"date-time"},"lifecycle_mode":{"type":"string","enum":["auto","manual","scheduled"]},"generate_job_id":{"type":"string","example":"gj_CH6TM91RCFPKSNMSQNM1GAPC"}}},"WebhookTestData":{"type":"object","description":"`POST /v1/webhooks/{id}/test`: the body you sent, under `payload`.","required":["test","payload"],"properties":{"test":{"type":"boolean","enum":[true]},"payload":{}}},"WebhookReportReadyData":{"type":"object","required":["id","object","status","row_count","truncated","error_code","attempt","completed_at"],"properties":{"id":{"type":"string","example":"rpt_S5X6VXJW2ZVPF49V66R461FA"},"object":{"type":"string","enum":["report"]},"status":{"type":"string","enum":["done","failed"]},"row_count":{"type":"integer"},"truncated":{"type":"boolean"},"error_code":{"type":"string","nullable":true},"attempt":{"type":"integer","minimum":1},"completed_at":{"type":"string","format":"date-time","nullable":true}}},"WebhookEvidenceProcessedData":{"type":"object","required":["id","object","dispute_id","status","rejection_reason","processed_at"],"properties":{"id":{"type":"string","example":"evd_…"},"object":{"type":"string","enum":["evidence"]},"dispute_id":{"type":"string"},"status":{"type":"string","enum":["available","rejected"]},"rejection_reason":{"type":"string","nullable":true},"processed_at":{"type":"string","format":"date-time"}}},"WebhookDelivery":{"type":"object","description":"The body of every webhook delivery. Signed as raw bytes; see `X-Dispute-Signature`.","required":["event","delivered_at","sequence","data"],"properties":{"event":{"type":"string","enum":["dispute.created","dispute.status_changed","dispute.evidence_added","dispute.note_added","report.ready","evidence.processed"]},"delivered_at":{"type":"string","format":"date-time","description":"When the first attempt was built; retries keep it."},"sequence":{"type":"integer","format":"int64","nullable":true,"description":"Grows with every delivery the platform creates (gaps are normal); order events by it. Null only when the counter could not be read."},"data":{"description":"Depends on `event`; see `x-webhooks`."}}}}},"x-webhooks":{"dispute.created":{"post":{"summary":"dispute.created","description":"Sent to every enabled webhook subscribed to it (an empty `events` list subscribes to all).","parameters":[{"name":"User-Agent","in":"header","required":true,"description":"`dispute.markets-webhooks/1`.","schema":{"type":"string"}},{"name":"X-Dispute-Event","in":"header","required":true,"description":"The event type (same as `event` in the body).","schema":{"type":"string"}},{"name":"X-Dispute-Delivery-Id","in":"header","required":true,"description":"`whd_…`; the same on every attempt of one delivery. De-duplicate on it.","schema":{"type":"string"}},{"name":"X-Dispute-Attempt","in":"header","required":true,"description":"1 to 5.","schema":{"type":"integer","minimum":1,"maximum":5}},{"name":"X-Dispute-Signature","in":"header","required":true,"description":"Lowercase hex HMAC-SHA256 of the raw body with the webhook secret.","schema":{"type":"string"}},{"name":"X-Dispute-Request-Id","in":"header","required":false,"description":"The `X-Request-Id` of the request that caused the event, when there was one.","schema":{"type":"string"}},{"name":"X-Dispute-Correlation-Id","in":"header","required":false,"description":"The caller's `X-Correlation-Id` on that request, when it sent one.","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/WebhookDelivery"},{"type":"object","properties":{"event":{"type":"string","enum":["dispute.created"]},"data":{"oneOf":[{"$ref":"#/components/schemas/WebhookGeneratedDisputeData"},{"$ref":"#/components/schemas/WebhookTestData"}]}}}]}}}},"responses":{"2XX":{"description":"Received. Answer within 10 s."},"default":{"description":"Not received: no response, 408, 409, 425, 429 and 5xx are retried with backoff; any other status is final."}}}},"dispute.status_changed":{"post":{"summary":"dispute.status_changed","description":"Sent to every enabled webhook subscribed to it (an empty `events` list subscribes to all).","parameters":[{"name":"User-Agent","in":"header","required":true,"description":"`dispute.markets-webhooks/1`.","schema":{"type":"string"}},{"name":"X-Dispute-Event","in":"header","required":true,"description":"The event type (same as `event` in the body).","schema":{"type":"string"}},{"name":"X-Dispute-Delivery-Id","in":"header","required":true,"description":"`whd_…`; the same on every attempt of one delivery. De-duplicate on it.","schema":{"type":"string"}},{"name":"X-Dispute-Attempt","in":"header","required":true,"description":"1 to 5.","schema":{"type":"integer","minimum":1,"maximum":5}},{"name":"X-Dispute-Signature","in":"header","required":true,"description":"Lowercase hex HMAC-SHA256 of the raw body with the webhook secret.","schema":{"type":"string"}},{"name":"X-Dispute-Request-Id","in":"header","required":false,"description":"The `X-Request-Id` of the request that caused the event, when there was one.","schema":{"type":"string"}},{"name":"X-Dispute-Correlation-Id","in":"header","required":false,"description":"The caller's `X-Correlation-Id` on that request, when it sent one.","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/WebhookDelivery"},{"type":"object","properties":{"event":{"type":"string","enum":["dispute.status_changed"]},"data":{"$ref":"#/components/schemas/WebhookDisputeEventData"}}}]}}}},"responses":{"2XX":{"description":"Received. Answer within 10 s."},"default":{"description":"Not received: no response, 408, 409, 425, 429 and 5xx are retried with backoff; any other status is final."}}}},"dispute.evidence_added":{"post":{"summary":"dispute.evidence_added","description":"Sent to every enabled webhook subscribed to it (an empty `events` list subscribes to all).","parameters":[{"name":"User-Agent","in":"header","required":true,"description":"`dispute.markets-webhooks/1`.","schema":{"type":"string"}},{"name":"X-Dispute-Event","in":"header","required":true,"description":"The event type (same as `event` in the body).","schema":{"type":"string"}},{"name":"X-Dispute-Delivery-Id","in":"header","required":true,"description":"`whd_…`; the same on every attempt of one delivery. De-duplicate on it.","schema":{"type":"string"}},{"name":"X-Dispute-Attempt","in":"header","required":true,"description":"1 to 5.","schema":{"type":"integer","minimum":1,"maximum":5}},{"name":"X-Dispute-Signature","in":"header","required":true,"description":"Lowercase hex HMAC-SHA256 of the raw body with the webhook secret.","schema":{"type":"string"}},{"name":"X-Dispute-Request-Id","in":"header","required":false,"description":"The `X-Request-Id` of the request that caused the event, when there was one.","schema":{"type":"string"}},{"name":"X-Dispute-Correlation-Id","in":"header","required":false,"description":"The caller's `X-Correlation-Id` on that request, when it sent one.","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/WebhookDelivery"},{"type":"object","properties":{"event":{"type":"string","enum":["dispute.evidence_added"]},"data":{"$ref":"#/components/schemas/WebhookDisputeEventData"}}}]}}}},"responses":{"2XX":{"description":"Received. Answer within 10 s."},"default":{"description":"Not received: no response, 408, 409, 425, 429 and 5xx are retried with backoff; any other status is final."}}}},"dispute.note_added":{"post":{"summary":"dispute.note_added","description":"Sent to every enabled webhook subscribed to it (an empty `events` list subscribes to all).","parameters":[{"name":"User-Agent","in":"header","required":true,"description":"`dispute.markets-webhooks/1`.","schema":{"type":"string"}},{"name":"X-Dispute-Event","in":"header","required":true,"description":"The event type (same as `event` in the body).","schema":{"type":"string"}},{"name":"X-Dispute-Delivery-Id","in":"header","required":true,"description":"`whd_…`; the same on every attempt of one delivery. De-duplicate on it.","schema":{"type":"string"}},{"name":"X-Dispute-Attempt","in":"header","required":true,"description":"1 to 5.","schema":{"type":"integer","minimum":1,"maximum":5}},{"name":"X-Dispute-Signature","in":"header","required":true,"description":"Lowercase hex HMAC-SHA256 of the raw body with the webhook secret.","schema":{"type":"string"}},{"name":"X-Dispute-Request-Id","in":"header","required":false,"description":"The `X-Request-Id` of the request that caused the event, when there was one.","schema":{"type":"string"}},{"name":"X-Dispute-Correlation-Id","in":"header","required":false,"description":"The caller's `X-Correlation-Id` on that request, when it sent one.","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/WebhookDelivery"},{"type":"object","properties":{"event":{"type":"string","enum":["dispute.note_added"]},"data":{"$ref":"#/components/schemas/WebhookDisputeEventData"}}}]}}}},"responses":{"2XX":{"description":"Received. Answer within 10 s."},"default":{"description":"Not received: no response, 408, 409, 425, 429 and 5xx are retried with backoff; any other status is final."}}}},"report.ready":{"post":{"summary":"report.ready","description":"Sent only to simulation subscribers (`accepts_simulation`) under the matching flow variant.","parameters":[{"name":"User-Agent","in":"header","required":true,"description":"`dispute.markets-webhooks/1`.","schema":{"type":"string"}},{"name":"X-Dispute-Event","in":"header","required":true,"description":"The event type (same as `event` in the body).","schema":{"type":"string"}},{"name":"X-Dispute-Delivery-Id","in":"header","required":true,"description":"`whd_…`; the same on every attempt of one delivery. De-duplicate on it.","schema":{"type":"string"}},{"name":"X-Dispute-Attempt","in":"header","required":true,"description":"1 to 5.","schema":{"type":"integer","minimum":1,"maximum":5}},{"name":"X-Dispute-Signature","in":"header","required":true,"description":"Lowercase hex HMAC-SHA256 of the raw body with the webhook secret.","schema":{"type":"string"}},{"name":"X-Dispute-Request-Id","in":"header","required":false,"description":"The `X-Request-Id` of the request that caused the event, when there was one.","schema":{"type":"string"}},{"name":"X-Dispute-Correlation-Id","in":"header","required":false,"description":"The caller's `X-Correlation-Id` on that request, when it sent one.","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/WebhookDelivery"},{"type":"object","properties":{"event":{"type":"string","enum":["report.ready"]},"data":{"$ref":"#/components/schemas/WebhookReportReadyData"}}}]}}}},"responses":{"2XX":{"description":"Received. Answer within 10 s."},"default":{"description":"Not received: no response, 408, 409, 425, 429 and 5xx are retried with backoff; any other status is final."}}}},"evidence.processed":{"post":{"summary":"evidence.processed","description":"Sent only to simulation subscribers (`accepts_simulation`) under the matching flow variant.","parameters":[{"name":"User-Agent","in":"header","required":true,"description":"`dispute.markets-webhooks/1`.","schema":{"type":"string"}},{"name":"X-Dispute-Event","in":"header","required":true,"description":"The event type (same as `event` in the body).","schema":{"type":"string"}},{"name":"X-Dispute-Delivery-Id","in":"header","required":true,"description":"`whd_…`; the same on every attempt of one delivery. De-duplicate on it.","schema":{"type":"string"}},{"name":"X-Dispute-Attempt","in":"header","required":true,"description":"1 to 5.","schema":{"type":"integer","minimum":1,"maximum":5}},{"name":"X-Dispute-Signature","in":"header","required":true,"description":"Lowercase hex HMAC-SHA256 of the raw body with the webhook secret.","schema":{"type":"string"}},{"name":"X-Dispute-Request-Id","in":"header","required":false,"description":"The `X-Request-Id` of the request that caused the event, when there was one.","schema":{"type":"string"}},{"name":"X-Dispute-Correlation-Id","in":"header","required":false,"description":"The caller's `X-Correlation-Id` on that request, when it sent one.","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/WebhookDelivery"},{"type":"object","properties":{"event":{"type":"string","enum":["evidence.processed"]},"data":{"$ref":"#/components/schemas/WebhookEvidenceProcessedData"}}}]}}}},"responses":{"2XX":{"description":"Received. Answer within 10 s."},"default":{"description":"Not received: no response, 408, 409, 425, 429 and 5xx are retried with backoff; any other status is final."}}}}}}