openapi: 3.0.3
info:
  title: TrueCaaS Externalized API Shape
  version: 1.0.0
  x-truecaas-api-version: v1
  description: |
    Public shape for the TrueCaaS V1 externalized API.
    This file intentionally omits tenant-specific IDs, app-specific values, internal operations APIs, and executable examples.
servers:
  - url: https://{tenant-host}
    description: Replace {tenant-host} with the tenant routed host supplied in your TrueCaaS account.
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
security:
  - bearerAuth: []
tags:
  - name: "Identity and login context"
    description: "Resolve the current subject, available applications, licensing context, and OIDC discovery for a tenant-routed host."
  - name: "Tenant administration"
    description: "Manage tenant profile, security posture, licensing refreshes, and user-facing notifications inside a paid or trial tenant."
  - name: "Tenant users and migration"
    description: "Create, import, update, credential-reset, and inspect tenant-level users and identity migration workflows."
  - name: "Environments and applications"
    description: "Model environments, applications, public registration settings, and app readiness for tenant-owned products."
  - name: "App users and RBAC"
    description: "Manage application users, roles, privileges, assignments, and effective access inside a specific tenant environment."
  - name: "Entitlements and governed actions"
    description: "Evaluate authorization decisions and coordinate governed action request, approval, consumption, and evidence flows."
  - name: "Audit, reporting, and SIEM"
    description: "Query authentication events, security audit streams, SIEM exports, IRP records, and generated report artifacts."
  - name: "Webhooks and outbound integrations"
    description: "Register event subscriptions, rotate secrets, test deliveries, and inspect webhook delivery outcomes."
  - name: "Federation and MFA"
    description: "Configure OIDC clients, SAML connections, LDAP connectors, and end-user MFA enrollment flows."
  - name: "Managed tenants and messaging"
    description: "Support account-managed tenants, bootstrap handoff, and tenant-scoped email/SMS messaging operations."
  - name: "MCP integration surface"
    description: "Invoke tenant-aware MCP paths where the tenant has enabled agent/tool integration patterns."
paths:
  /.well-known/openid-configuration:
    get:
      operationId: "get-well-known-openid-configuration"
      tags: ["Identity and login context"]
      summary: "Tenant OIDC discovery document"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/auth/resolve-login-context:
    get:
      operationId: "get-api-v1-auth-resolve-login-context"
      tags: ["Identity and login context"]
      summary: "Resolve hosted-login routing context"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/me:
    get:
      operationId: "get-api-v1-me"
      tags: ["Identity and login context"]
      summary: "Current authenticated subject"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/me/applications:
    get:
      operationId: "get-api-v1-me-applications"
      tags: ["Identity and login context"]
      summary: "Applications available to the current subject"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/me/licensing:
    get:
      operationId: "get-api-v1-me-licensing"
      tags: ["Identity and login context"]
      summary: "License posture visible to the current subject"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}:
    get:
      operationId: "get-api-v1-tenant-by-tenantid"
      tags: ["Tenant administration"]
      summary: "Read tenant profile"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid"
      tags: ["Tenant administration"]
      summary: "Update tenant profile"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/settings/security:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-settings-security"
      tags: ["Tenant administration"]
      summary: "Read tenant security settings"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-settings-security"
      tags: ["Tenant administration"]
      summary: "Update tenant security settings"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/licensing:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-licensing"
      tags: ["Tenant administration"]
      summary: "Read tenant licensing state"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/licensing/refresh:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-licensing-refresh"
      tags: ["Tenant administration"]
      summary: "Refresh tenant licensing state"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/notifications:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-notifications"
      tags: ["Tenant administration"]
      summary: "List tenant notifications"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/notifications/read:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-notifications-read"
      tags: ["Tenant administration"]
      summary: "Mark tenant notifications as read"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/users:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-users"
      tags: ["Tenant users and migration"]
      summary: "List tenant users"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-users"
      tags: ["Tenant users and migration"]
      summary: "Create tenant user"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/users/import:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-users-import"
      tags: ["Tenant users and migration"]
      summary: "Import tenant users"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/users/import/directory:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-users-import-directory"
      tags: ["Tenant users and migration"]
      summary: "Import tenant users from directory data"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/users/{userId}:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-users-by-userid"
      tags: ["Tenant users and migration"]
      summary: "Read tenant user"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-users-by-userid"
      tags: ["Tenant users and migration"]
      summary: "Update tenant user"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    delete:
      operationId: "delete-api-v1-tenant-by-tenantid-users-by-userid"
      tags: ["Tenant users and migration"]
      summary: "Delete tenant user"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/users/{userId}/reset-password:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-users-by-userid-reset-password"
      tags: ["Tenant users and migration"]
      summary: "Issue tenant user password reset"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/users/{userId}/reset-mfa:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-users-by-userid-reset-mfa"
      tags: ["Tenant users and migration"]
      summary: "Reset tenant user MFA state"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/users/{userId}/access-visualizer:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-users-by-userid-access-visualizer"
      tags: ["Tenant users and migration"]
      summary: "Inspect tenant user access context"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/migrations/identity/adapters:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-migrations-identity-adapters"
      tags: ["Tenant users and migration"]
      summary: "List identity migration adapters"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/migrations/identity/dry-run:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-migrations-identity-dry-run"
      tags: ["Tenant users and migration"]
      summary: "Preview identity migration impact"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/migrations/identity/apply:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-migrations-identity-apply"
      tags: ["Tenant users and migration"]
      summary: "Apply identity migration batch"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments"
      tags: ["Environments and applications"]
      summary: "List environments"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments"
      tags: ["Environments and applications"]
      summary: "Create environment"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env"
      tags: ["Environments and applications"]
      summary: "Read environment"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-environments-by-env"
      tags: ["Environments and applications"]
      summary: "Update environment"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    delete:
      operationId: "delete-api-v1-tenant-by-tenantid-environments-by-env"
      tags: ["Environments and applications"]
      summary: "Delete environment"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications"
      tags: ["Environments and applications"]
      summary: "List applications"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications"
      tags: ["Environments and applications"]
      summary: "Create application"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid"
      tags: ["Environments and applications"]
      summary: "Read application"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid"
      tags: ["Environments and applications"]
      summary: "Update application"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    delete:
      operationId: "delete-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid"
      tags: ["Environments and applications"]
      summary: "Delete application"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/settings/security:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-settings-security"
      tags: ["Environments and applications"]
      summary: "Read application security settings"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-settings-security"
      tags: ["Environments and applications"]
      summary: "Update application security settings"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/settings/public-registration:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-settings-public-registration"
      tags: ["Environments and applications"]
      summary: "Read public registration settings"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-settings-public-registration"
      tags: ["Environments and applications"]
      summary: "Update public registration settings"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/readiness:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-readiness"
      tags: ["Environments and applications"]
      summary: "Read application readiness"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-users"
      tags: ["App users and RBAC"]
      summary: "List application users"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-users"
      tags: ["App users and RBAC"]
      summary: "Create application user"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-users-by-appuserid"
      tags: ["App users and RBAC"]
      summary: "Read application user"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-users-by-appuserid"
      tags: ["App users and RBAC"]
      summary: "Update application user"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    delete:
      operationId: "delete-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-users-by-appuserid"
      tags: ["App users and RBAC"]
      summary: "Delete application user"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}/reset-password:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-users-by-appuserid-reset-password"
      tags: ["App users and RBAC"]
      summary: "Issue application user password reset"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-roles"
      tags: ["App users and RBAC"]
      summary: "List application roles"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-roles"
      tags: ["App users and RBAC"]
      summary: "Create application role"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles/{roleId}:
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-roles-by-roleid"
      tags: ["App users and RBAC"]
      summary: "Update application role"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    delete:
      operationId: "delete-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-roles-by-roleid"
      tags: ["App users and RBAC"]
      summary: "Delete application role"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/privileges:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-privileges"
      tags: ["App users and RBAC"]
      summary: "List application privileges"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-privileges"
      tags: ["App users and RBAC"]
      summary: "Create application privilege"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles/{roleId}/users/{appUserId}:
    put:
      operationId: "put-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-roles-by-roleid-users-by-appuserid"
      tags: ["App users and RBAC"]
      summary: "Assign user to role"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    delete:
      operationId: "delete-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-roles-by-roleid-users-by-appuserid"
      tags: ["App users and RBAC"]
      summary: "Remove user from role"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}/privileges:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-users-by-appuserid-privileges"
      tags: ["App users and RBAC"]
      summary: "Read effective user privileges"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/entitlements/check:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-entitlements-check"
      tags: ["Entitlements and governed actions"]
      summary: "Evaluate entitlement decision"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/actions:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-governed-actions-actions"
      tags: ["Entitlements and governed actions"]
      summary: "List governed actions"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-governed-actions-actions"
      tags: ["Entitlements and governed actions"]
      summary: "Create governed action"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-governed-actions-requests"
      tags: ["Entitlements and governed actions"]
      summary: "List governed action requests"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-governed-actions-requests"
      tags: ["Entitlements and governed actions"]
      summary: "Create governed action request"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/approve:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-governed-actions-requests-by-requestid-approve"
      tags: ["Entitlements and governed actions"]
      summary: "Approve governed action request"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/reject:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-governed-actions-requests-by-requestid-reject"
      tags: ["Entitlements and governed actions"]
      summary: "Reject governed action request"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/consume:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-governed-actions-requests-by-requestid-consume"
      tags: ["Entitlements and governed actions"]
      summary: "Consume governed action approval"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/evidence:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-governed-actions-requests-by-requestid-evidence"
      tags: ["Entitlements and governed actions"]
      summary: "Attach governed action evidence"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/events:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-events"
      tags: ["Audit, reporting, and SIEM"]
      summary: "List tenant events"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/audit/events:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-audit-events"
      tags: ["Audit, reporting, and SIEM"]
      summary: "List tenant audit events"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/audit/siem/events:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-audit-siem-events"
      tags: ["Audit, reporting, and SIEM"]
      summary: "Export SIEM-compatible audit events"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/irp/records:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-irp-records"
      tags: ["Audit, reporting, and SIEM"]
      summary: "List IRP-backed decision records"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/reports/jobs:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-reports-jobs"
      tags: ["Audit, reporting, and SIEM"]
      summary: "List report jobs"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-reports-jobs"
      tags: ["Audit, reporting, and SIEM"]
      summary: "Create report job"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/reports/jobs/{jobId}:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-reports-jobs-by-jobid"
      tags: ["Audit, reporting, and SIEM"]
      summary: "Read report job status"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/reports/jobs/{jobId}/artifact:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-reports-jobs-by-jobid-artifact"
      tags: ["Audit, reporting, and SIEM"]
      summary: "Download report artifact"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/webhooks/event-types:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-webhooks-event-types"
      tags: ["Webhooks and outbound integrations"]
      summary: "List webhook event types"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/webhooks/subscriptions:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-webhooks-subscriptions"
      tags: ["Webhooks and outbound integrations"]
      summary: "List webhook subscriptions"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-webhooks-subscriptions"
      tags: ["Webhooks and outbound integrations"]
      summary: "Create webhook subscription"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-webhooks-subscriptions-by-subid"
      tags: ["Webhooks and outbound integrations"]
      summary: "Read webhook subscription"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-webhooks-subscriptions-by-subid"
      tags: ["Webhooks and outbound integrations"]
      summary: "Update webhook subscription"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    delete:
      operationId: "delete-api-v1-tenant-by-tenantid-webhooks-subscriptions-by-subid"
      tags: ["Webhooks and outbound integrations"]
      summary: "Delete webhook subscription"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/secret:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-webhooks-subscriptions-by-subid-secret"
      tags: ["Webhooks and outbound integrations"]
      summary: "Read webhook secret metadata"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-webhooks-subscriptions-by-subid-secret"
      tags: ["Webhooks and outbound integrations"]
      summary: "Create webhook secret"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/rotate:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-webhooks-subscriptions-by-subid-rotate"
      tags: ["Webhooks and outbound integrations"]
      summary: "Rotate webhook secret"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/test:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-webhooks-subscriptions-by-subid-test"
      tags: ["Webhooks and outbound integrations"]
      summary: "Send webhook test delivery"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/webhooks/deliveries:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-webhooks-deliveries"
      tags: ["Webhooks and outbound integrations"]
      summary: "List webhook deliveries"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/oauth2/clients:
    get:
      operationId: "get-api-v1-oauth2-clients"
      tags: ["Federation and MFA"]
      summary: "List OIDC clients"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-oauth2-clients"
      tags: ["Federation and MFA"]
      summary: "Create OIDC client"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/oauth2/clients/{clientId}:
    patch:
      operationId: "patch-api-v1-oauth2-clients-by-clientid"
      tags: ["Federation and MFA"]
      summary: "Update OIDC client"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    delete:
      operationId: "delete-api-v1-oauth2-clients-by-clientid"
      tags: ["Federation and MFA"]
      summary: "Delete OIDC client"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/saml/connections:
    get:
      operationId: "get-api-v1-saml-connections"
      tags: ["Federation and MFA"]
      summary: "List SAML connections"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-saml-connections"
      tags: ["Federation and MFA"]
      summary: "Create SAML connection"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/saml/connections/{connectionId}:
    patch:
      operationId: "patch-api-v1-saml-connections-by-connectionid"
      tags: ["Federation and MFA"]
      summary: "Update SAML connection"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    delete:
      operationId: "delete-api-v1-saml-connections-by-connectionid"
      tags: ["Federation and MFA"]
      summary: "Delete SAML connection"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/settings/ldap:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-settings-ldap"
      tags: ["Federation and MFA"]
      summary: "Read LDAP settings"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-settings-ldap"
      tags: ["Federation and MFA"]
      summary: "Update LDAP settings"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/settings/ldap/connectors:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-settings-ldap-connectors"
      tags: ["Federation and MFA"]
      summary: "List LDAP connectors"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-settings-ldap-connectors"
      tags: ["Federation and MFA"]
      summary: "Create LDAP connector"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/mfa/totp/enroll:
    post:
      operationId: "post-api-v1-mfa-totp-enroll"
      tags: ["Federation and MFA"]
      summary: "Enroll TOTP MFA"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/mfa/totp/enable:
    post:
      operationId: "post-api-v1-mfa-totp-enable"
      tags: ["Federation and MFA"]
      summary: "Enable TOTP MFA"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/mfa/sms/enroll:
    post:
      operationId: "post-api-v1-mfa-sms-enroll"
      tags: ["Federation and MFA"]
      summary: "Enroll SMS MFA"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/mfa/passkeys/register/options:
    post:
      operationId: "post-api-v1-mfa-passkeys-register-options"
      tags: ["Federation and MFA"]
      summary: "Create passkey registration options"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/mfa/passkeys/register/verify:
    post:
      operationId: "post-api-v1-mfa-passkeys-register-verify"
      tags: ["Federation and MFA"]
      summary: "Verify passkey registration"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/managed-tenants:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-managed-tenants"
      tags: ["Managed tenants and messaging"]
      summary: "List managed tenants"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    post:
      operationId: "post-api-v1-tenant-by-tenantid-managed-tenants"
      tags: ["Managed tenants and messaging"]
      summary: "Create managed tenant"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/managed-tenants/{managedTenantId}:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-managed-tenants-by-managedtenantid"
      tags: ["Managed tenants and messaging"]
      summary: "Read managed tenant"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    patch:
      operationId: "patch-api-v1-tenant-by-tenantid-managed-tenants-by-managedtenantid"
      tags: ["Managed tenants and messaging"]
      summary: "Update managed tenant"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
    delete:
      operationId: "delete-api-v1-tenant-by-tenantid-managed-tenants-by-managedtenantid"
      tags: ["Managed tenants and messaging"]
      summary: "Delete managed tenant"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/managed-tenants/{managedTenantId}/bootstrap:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-managed-tenants-by-managedtenantid-bootstrap"
      tags: ["Managed tenants and messaging"]
      summary: "Bootstrap managed tenant handoff"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/messaging/email/send:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-messaging-email-send"
      tags: ["Managed tenants and messaging"]
      summary: "Send tenant email"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/messaging/email/logs:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-messaging-email-logs"
      tags: ["Managed tenants and messaging"]
      summary: "List tenant email logs"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/messaging/sms/logs:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-messaging-sms-logs"
      tags: ["Managed tenants and messaging"]
      summary: "List tenant SMS logs"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/messaging/sms/ledger:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-messaging-sms-ledger"
      tags: ["Managed tenants and messaging"]
      summary: "Read tenant SMS ledger"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/messaging/email/send:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-messaging-email-send"
      tags: ["Managed tenants and messaging"]
      summary: "Send app-scoped email"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/messaging/email/logs:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-messaging-email-logs"
      tags: ["Managed tenants and messaging"]
      summary: "List app-scoped email logs"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/messaging/sms/logs:
    get:
      operationId: "get-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-messaging-sms-logs"
      tags: ["Managed tenants and messaging"]
      summary: "List app-scoped SMS logs"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/mcp:
    post:
      operationId: "post-api-v1-mcp"
      tags: ["MCP integration surface"]
      summary: "Invoke root MCP endpoint"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
  /api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/mcp:
    post:
      operationId: "post-api-v1-tenant-by-tenantid-environments-by-env-applications-by-appid-mcp"
      tags: ["MCP integration surface"]
      summary: "Invoke app-scoped MCP endpoint"
      responses:
        "200":
          description: Request accepted for an authenticated tenant context.
        "401":
          description: Missing, expired, or invalid bearer token.
        "403":
          description: Authenticated subject is not allowed to perform this action.
