{"openapi":"3.1.0","info":{"title":"Oxelone API","description":"Read your fleet, its AI activity and its issues, and manage policies from your own scripts. Create a key in Settings › Access › API keys and send it as `Authorization: Bearer oxel_…`; a key acts as one role in one workspace and always expires.","license":{"name":""},"version":"0.1.0"},"paths":{"/ai-tool-settings":{"get":{"tags":["inventory"],"summary":"AI tool settings","description":"This workspace's AI tool settings, or the defaults when it has never set any.\n\nAn empty `corporate_domains` is the default and is a working configuration,\nnot an error state: with nothing configured, a built-in list of consumer\nproviders applies.","operationId":"getAiToolSettings","responses":{"200":{"description":"The workspace's corporate email domains","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AiToolSettingsView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]},"put":{"tags":["inventory"],"summary":"Replace this workspace's corporate domain list.","description":"Replace this workspace's corporate domain list.\n\nThe list you send replaces the whole list; there is no add or remove.\n\nEvery change is recorded in the audit log, with the list as stored, which\nis the list that will actually be used rather than the one that was sent.","operationId":"updateAiToolSettings","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutAiToolSettingsRequest"}}},"required":true},"responses":{"200":{"description":"The stored settings, after normalisation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AiToolSettingsView"}}}},"400":{"description":"Malformed body, or an entry that is not a bare domain — the message names it"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/ai-tools/locks/{lock_id}/unlock":{"post":{"tags":["inventory"],"summary":"Unlock a session lock","description":"The lock stays in place until the machine's next check-in carries the\nunlock. Calling this again gives the same answer. Recorded in the audit log.","operationId":"unlockSessionLock","parameters":[{"name":"lock_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnlockResponse"}}}},"403":{"description":"Unlocking requires policies:write in this workspace"},"404":{"description":"No live lock with this id in this workspace"}},"security":[{"apiKey":[]}]}},"/ai-tools/{artifact}":{"get":{"tags":["inventory"],"summary":"One AI tool on one machine","description":"The tool's header, counts, coverage and the policies that govern it. `artifact` is the AI\ntool's artifact id; 404 when this workspace holds no such AI tool.","operationId":"getAiToolPage","parameters":[{"name":"artifact","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ToolPageView"}}}},"404":{"description":"No such AI tool in this workspace"}},"security":[{"apiKey":[]}]}},"/ai-tools/{artifact}/sessions":{"get":{"tags":["inventory"],"summary":"List an AI tool's sessions","description":"One tool's sessions on one machine, newest first, paged by cursor.","operationId":"listAiToolSessions","parameters":[{"name":"artifact","in":"path","required":true,"schema":{"type":"string"}},{"name":"since","in":"query","description":"`1d`, `7d` or `30d` (the default).","required":false,"schema":{"type":"string"}},{"name":"project","in":"query","required":false,"schema":{"type":"string"}},{"name":"mode","in":"query","description":"An oversight word: the session ran in it at some point.","required":false,"schema":{"type":"string"}},{"name":"after","in":"query","description":"The `next` of the previous page.","required":false,"schema":{"type":"string"}},{"name":"limit","in":"query","description":"At most 50.","required":false,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ToolSessionsPage"}}}},"400":{"description":"A malformed filter"},"404":{"description":"No such AI tool in this workspace"}},"security":[{"apiKey":[]}]}},"/ai-tools/{artifact}/sessions/{session_id}":{"get":{"tags":["inventory"],"summary":"One session of one tool.","operationId":"getAiToolSession","parameters":[{"name":"artifact","in":"path","required":true,"schema":{"type":"string"}},{"name":"session_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ToolSessionDetail"}}}},"404":{"description":"No such session of this tool"}},"security":[{"apiKey":[]}]}},"/alerts":{"get":{"tags":["alerts"],"summary":"List alerts","description":"What a policy's Alert action or a justified override raised, newest first.","operationId":"listAlerts","parameters":[{"name":"f","in":"query","description":"The filter expression, e.g. `all;outcome~in~undetermined;mode~in~monitor`.\n\nThe first segment is the join (`all` or `any`); each later segment is\n`field~op~values`, with `op` one of `in`, `nin`, `before`, `after` and\nvalues separated by commas. Fields: `outcome`, `mode`, `severity`,\n`policy`, `machine`, `service`, `interaction`, `at`. A malformed segment\nis ignored; a field this list does not have is a 400 naming it.","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","description":"Where the previous page stopped. Opaque; an unreadable one starts over.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Rows wanted. Clamped to 200.","required":false,"schema":{"type":["integer","null"],"format":"int64"}},{"name":"raised_by","in":"query","description":"`action` or `justification`: narrow to what raised the alert. Anything\nelse is a 400 naming it.","required":false,"schema":{"type":["string","null"]}},{"name":"include_removed","in":"query","description":"`true` also lists alerts whose machine or connection was removed. They\nare kept as audit history and are left out of the default list.","required":false,"schema":{"type":["boolean","null"]}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertListResponse"}}}},"400":{"description":"The filter names a field or value this surface does not have"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks alerts:read in this workspace"}},"security":[{"apiKey":[]}]}},"/alerts/{alert}":{"get":{"tags":["alerts"],"summary":"One alert, by its id.","description":"A **404** for an unknown id and for one belonging to another workspace, which is\ndeliberately not a 403: a 403 would confirm the id exists somewhere, which is\nthe one thing a probe wants to learn, and the rest of this API already\nanswers a cross-workspace id this way.","operationId":"getAlert","parameters":[{"name":"alert","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks alerts:read in this workspace"},"404":{"description":"No such alert in this workspace"}},"security":[{"apiKey":[]}]}},"/artifacts":{"get":{"tags":["inventory"],"summary":"The AI Artifacts index.","operationId":"listArtifacts","parameters":[{"name":"f","in":"query","description":"The filter expression, e.g. `all;category~in~agent_skill;severity~nin~low`.\n\nA malformed segment is dropped; a field this list does not have is a 400\nnaming it.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"Free text over name and location. ANDs with the expression whichever way\nits conditions are joined.","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","description":"Where the previous page stopped. Opaque; an unreadable one starts over.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Rows wanted, at most 200; a larger value returns 200.","required":false,"schema":{"type":["integer","null"],"format":"int64"}},{"name":"group","in":"query","description":"Fold the matched set instead of paging it.\n\n`catalogued_identity`, `catalogued`, `machine`, `owner` or `category`.\n**The rollup covers everything the filter matched, not the page** — the\ndeleted AI Components page answered *how widely is this in use*, and an\nanswer folded from fifty rows would be an answer about fifty rows.\n\nAn unknown value is a 400 naming the five, for the reason an unknown\nfilter field is: a silently ignored `group` returns a page of rows to a\ncaller that asked for groups.","required":false,"schema":{"type":["string","null"]}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactListResponse"}}}}},"security":[{"apiKey":[]}]}},"/artifacts/{artifact}":{"get":{"tags":["inventory"],"summary":"One artifact, for the drawer.","operationId":"getArtifact","parameters":[{"name":"artifact","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactDetailResponse"}}}},"404":{"description":"No such artifact in this workspace"}},"security":[{"apiKey":[]}]}},"/artifacts/{artifact}/tags":{"put":{"tags":["inventory"],"summary":"Replace an artifact's tags.","operationId":"put_artifact_tags","parameters":[{"name":"artifact","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutTagsRequest"}}},"required":true},"responses":{"200":{"description":"The stored set, after normalisation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TagListResponse"}}}},"400":{"description":"Malformed body, or an entry that is not a tag — the message names it"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such artifact in this workspace"}},"security":[{"apiKey":[]}]}},"/comments":{"get":{"tags":["activity"],"summary":"One subject's thread.","operationId":"listComments","parameters":[{"name":"subject_kind","in":"query","description":"`artifact` or `issue`.","required":false,"schema":{"type":["string","null"]}},{"name":"subject_id","in":"query","required":false,"schema":{"type":["string","null"]}}],"responses":{"200":{"description":"The thread, oldest first, tombstones included","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommentListResponse"}}}},"400":{"description":"Missing or unknown subject_kind"},"403":{"description":"Caller lacks the grant that reads this subject"},"404":{"description":"No such subject in this workspace"}},"security":[{"apiKey":[]}]},"post":{"tags":["activity"],"summary":"Add a comment, or a reply.","description":"Recorded in the audit log by its ids, never its text.","operationId":"post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostCommentRequest"}}},"required":true},"responses":{"200":{"description":"The stored comment","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommentView"}}}},"400":{"description":"Empty or over-long body, an unknown subject kind, or a reply to a reply"},"403":{"description":"Caller lacks the grant that reads this subject"},"404":{"description":"No such subject in this workspace"}},"security":[{"apiKey":[]}]}},"/comments/{comment}":{"delete":{"tags":["activity"],"summary":"Withdraw your own comment.","description":"Returns the **tombstone**, not `204`: the drawer replaces the row in place\nrather than removing it, and giving it the row back means it does not have\nto re-fetch the thread to find out what happened.\n\n**Audited.** Taking a statement back out of a record of what was decided is\nexactly the act somebody will later need to account for, and the row it\nleaves behind no longer says who wrote it — the tombstone keeps `author_id`,\nbut only the audit log says *when* and by whom it was withdrawn.","operationId":"withdraw","parameters":[{"name":"comment","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The tombstone","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommentView"}}}},"403":{"description":"The comment belongs to somebody else"},"404":{"description":"No such comment in this workspace"}},"security":[{"apiKey":[]}]}},"/decisions":{"get":{"tags":["policies"],"summary":"List decisions","description":"Decisions newest first, each with the engine runs that fed it. Page with\n`after`, passing the previous page's `next`.","operationId":"listDecisions","parameters":[{"name":"window","in":"query","description":"`1h`, `24h`, `7d` or `30d`. Defaults to `24h`.","required":false,"schema":{"type":["string","null"]}},{"name":"policy","in":"query","description":"A policy id, the workspace's own or a provided one.","required":false,"schema":{"type":["string","null"]}},{"name":"outcome","in":"query","description":"`blocked | alerted | justified | undetermined | passed`.","required":false,"schema":{"type":["string","null"]}},{"name":"f","in":"query","description":"The filter expression, e.g. `all;outcome~in~blocked;action~in~redact`.\n\nJoined by `all`, each segment `field~in~values` with values separated\nby commas. Fields: `outcome`, `policy`, `action` (`block`, `redact`,\n`ask`, `connector_action`), `engine`, `machine`, `inspection`\n(`not_inspected`: content not inspected because of its size). A field\nor value this list does not have is a 400 naming it.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"Free text over a reference, a user, a hostname and, on a connector\naction, its record and connection.","required":false,"schema":{"type":["string","null"]}},{"name":"reference","in":"query","description":"One decision by its reference, a filter of its own. A malformed\nreference is a 400. With no `window` named, the window is unbounded.","required":false,"schema":{"type":["string","null"]}},{"name":"include_removed","in":"query","description":"Keep rows whose machine or connection was removed. Default false; a\nread scoped by `interaction` or `reference` ignores it.","required":false,"schema":{"type":["boolean","null"]}},{"name":"interaction","in":"query","description":"An interaction id: every decision about that one interaction, whatever\nits outcome. With no `window` named, the window is unbounded.","required":false,"schema":{"type":["string","null"]}},{"name":"after","in":"query","description":"The `next` of the previous page.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Clamped to 1–200; default 50.","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"A page of decisions with their runs","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DecisionPage"}}}},"400":{"description":"A window, policy, outcome, facet, reference or cursor this endpoint does not accept"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks both policies:read and alerts:read in this workspace"}},"security":[{"apiKey":[]}]}},"/decisions/by-reference/{reference}":{"get":{"tags":["policies"],"summary":"One decision by reference","description":"One decision by the reference a person was shown when their request was\nstopped. A malformed reference is a 400 naming the format.","operationId":"getDecisionByReference","parameters":[{"name":"reference","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The decision the reference names","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DecisionDetail"}}}},"400":{"description":"Not a well-formed reference; the message names the format"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks both policies:read and alerts:read in this workspace"},"404":{"description":"No decision with that reference in this workspace"}},"security":[{"apiKey":[]}]}},"/decisions/kpis":{"get":{"tags":["policies"],"summary":"Decision counts","description":"The window's decision counts, and the 95th-percentile engine time in\nmilliseconds.","operationId":"getDecisionKpis","parameters":[{"name":"window","in":"query","description":"`1h`, `24h`, `7d` or `30d`. Defaults to `24h`.","required":false,"schema":{"type":["string","null"]}},{"name":"include_removed","in":"query","description":"Count rows whose machine or connection was removed. Default false.","required":false,"schema":{"type":["boolean","null"]}}],"responses":{"200":{"description":"Counts over the window","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DecisionKpis"}}}},"400":{"description":"The window is not one of 1h, 24h, 7d, 30d"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"}},"security":[{"apiKey":[]}]}},"/decisions/summary":{"get":{"tags":["policies"],"summary":"Decisions per policy","description":"Per policy: decisions by outcome over the window, and why undetermined.","operationId":"getDecisionsSummary","parameters":[{"name":"window","in":"query","description":"`1h`, `24h`, `7d` or `30d`. Defaults to `24h`.","required":false,"schema":{"type":["string","null"]}}],"responses":{"200":{"description":"Decisions per policy over the window","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DecisionsSummary"}}}},"400":{"description":"The window is not one of 1h, 24h, 7d, 30d"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"}},"security":[{"apiKey":[]}]}},"/decisions/{id}":{"get":{"tags":["policies"],"summary":"One decision","description":"One decision or connector action by its id, of any age, removed or not.\nAn unknown id, a malformed one and another workspace's are all 404.","operationId":"getDecision","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The decision, its runs and the issue it joined","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DecisionDetail"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks both policies:read and alerts:read in this workspace"},"404":{"description":"No decision with that id in this workspace"}},"security":[{"apiKey":[]}]}},"/file-events":{"get":{"tags":["activity"],"summary":"File events — fleet-wide, or one artifact's timeline.","description":"One route for both, because they are one question asked at two scopes. A\nseparate timeline endpoint would be a second place to add an event kind, and\nthe day somebody added one to only the first is the day the drawer started\nlying by omission.","operationId":"list_events","parameters":[{"name":"f","in":"query","description":"The filter expression. Fields: `kind`, `machine`, `artifact`,\n`category`, `at`.\n\n**The drawer's timeline is this and not a second parameter**:\n`all;artifact~in~<id>`. An `artifact_id` shortcut beside `f` would be a\nsecond way to say one thing, and the two would answer differently the\nfirst time one of them learned about a new event kind.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"Free text over the artifact's name and location.","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FileEventListResponse"}}}}},"security":[{"apiKey":[]}]}},"/file-events/{event}":{"get":{"tags":["activity"],"summary":"One file event","description":"One file event, by id. 404 for anything this workspace does not hold:\nan unknown id, another workspace's event, or a value that is not an id at\nall.","operationId":"getFileEvent","parameters":[{"name":"event","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FileEventView"}}}},"404":{"description":"No such event in this workspace"}},"security":[{"apiKey":[]}]}},"/hook-capabilities":{"get":{"tags":["policies"],"summary":"What each hook tool can do with each action.","description":"`policies:read`: it describes the authoring surface and reveals nothing a policy reader may\nnot already see — the same gate as the capabilities document.","operationId":"getHookCapabilities","responses":{"200":{"description":"Each hook tool's block, native ask and companion ask per action","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HookCapabilitiesView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/interactions":{"get":{"tags":["activity"],"summary":"The Interactions log — intercepted prompts, newest first.","operationId":"listInteractions","parameters":[{"name":"f","in":"query","description":"The filter expression, e.g.\n`all;service~in~anthropic;outcome~in~blocked`.\n\nThe first segment is the join (`all` or `any`); each later segment is\n`field~op~values`, with `op` one of `in`, `nin`, `before`, `after` and\nvalues separated by commas. A malformed segment is ignored; a field\nthis list does not have is a 400 naming it.\n\nFields: `service`, `host`, `client_kind`, `client_name`, `tactic`,\n`outcome`, `prompt`, `machine`, `user`, `account`, `session`,\n`correlation`, `at`. `user` is the OS account signed in to the machine;\n`account` is the account signed in to the AI service.\n`all;session~in~<id>` lists one session. `correlation` is the id a hook\nrow shares with the network row it caused, so\n`all;correlation~in~<id>` returns both halves of one interaction.\n\n`prompt` takes `found` (a prompt was read from the request), `none`\n(the request was read and held no prompt) or `unread` (the request was\nnever read for a prompt). `all;prompt~in~found` is the log of what\npeople actually typed.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"Free text over the service, host, endpoint and declared tool name. ANDs\nwith the expression whichever way its conditions are joined.\n\n**It does not reach the prompt.** Searching bodies would let a caller\nconfirm a string is in somebody's prompt without rendering it, which is\nthe one thing a content grant exists to govern.","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","description":"Where the previous page stopped. Opaque; an unreadable one starts over.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Rows wanted. Clamped to 200.","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InteractionListResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"}},"security":[{"apiKey":[]}]}},"/interactions/by-session":{"get":{"tags":["activity"],"summary":"List interactions grouped by session","description":"A page of sessions, newest activity first. A session is on the page when\nany of its interactions matches `f` and `q`, ordered by its newest\nmatching one; `matched` says how many matched. Metadata only: read a\nsession's interactions with `GET /interactions/by-session/rows`.","operationId":"listInteractionSessionPage","parameters":[{"name":"f","in":"query","description":"The filter expression, e.g.\n`all;service~in~anthropic;outcome~in~blocked`.\n\nThe first segment is the join (`all` or `any`); each later segment is\n`field~op~values`, with `op` one of `in`, `nin`, `before`, `after` and\nvalues separated by commas. A malformed segment is ignored; a field\nthis list does not have is a 400 naming it.\n\nFields: `service`, `host`, `client_kind`, `client_name`, `tactic`,\n`outcome`, `prompt`, `machine`, `user`, `account`, `session`,\n`correlation`, `at`. `user` is the OS account signed in to the machine;\n`account` is the account signed in to the AI service.\n`all;session~in~<id>` lists one session. `correlation` is the id a hook\nrow shares with the network row it caused, so\n`all;correlation~in~<id>` returns both halves of one interaction.\n\n`prompt` takes `found` (a prompt was read from the request), `none`\n(the request was read and held no prompt) or `unread` (the request was\nnever read for a prompt). `all;prompt~in~found` is the log of what\npeople actually typed.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"Free text over the service, host, endpoint and declared tool name. ANDs\nwith the expression whichever way its conditions are joined.\n\n**It does not reach the prompt.** Searching bodies would let a caller\nconfirm a string is in somebody's prompt without rendering it, which is\nthe one thing a content grant exists to govern.","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","description":"Where the previous page stopped. Opaque; an unreadable one starts over.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Rows wanted. Clamped to 200.","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InteractionSessionPageResponse"}}}},"400":{"description":"The filter names a field this list does not have"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"}},"security":[{"apiKey":[]}]}},"/interactions/by-session/rows":{"get":{"tags":["activity"],"summary":"One session's interactions","description":"The interactions in one session that the filter matches, oldest first.\nRows, permissions and content rules are the same as on\n`GET /interactions`.","operationId":"listSessionInteractions","parameters":[{"name":"session","in":"query","description":"The session whose interactions to read, verbatim. Exactly one of this\nand `unsessioned`.","required":false,"schema":{"type":["string","null"]}},{"name":"unsessioned","in":"query","description":"`true` reads the interactions that carry no session id — the list's\n*No session* group.","required":false,"schema":{"type":["boolean","null"]}},{"name":"f","in":"query","description":"The list's filter expression, as on `GET /interactions`.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"The list's free text, as on `GET /interactions`.","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","description":"Where the previous page stopped. Opaque; an unreadable one starts over.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Rows wanted. Clamped to 200.","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InteractionListResponse"}}}},"400":{"description":"Neither or both of `session` and `unsessioned`, or a field this list does not have"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"}},"security":[{"apiKey":[]}]}},"/interactions/sessions":{"get":{"tags":["activity"],"summary":"Session summaries","description":"Summaries of the sessions named by `ids`. Metadata only: counts, a tool\nname, an OS account and a machine. A session id with no interactions is\nleft out of the answer.","operationId":"listInteractionSessions","parameters":[{"name":"ids","in":"query","description":"Session ids, one per repeated `ids` parameter (`?ids=a&ids=b`).\n\nRepeated rather than comma-separated because a session id is the AI\nservice's own text and may itself hold a comma or leading and trailing\nspaces; each value is taken verbatim. At most 100, each at most 256\nbytes; an id with no interactions is left out of the answer rather\nthan being an error.","required":true,"schema":{"type":"array","items":{"type":"string"}}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InteractionSessionListResponse"}}}},"400":{"description":"More than 100 session ids"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"}},"security":[{"apiKey":[]}]}},"/interactions/{interaction}":{"get":{"tags":["activity"],"summary":"One interaction, for the drawer.","description":"The same projection the list returns, so a row and the drawer opened from it\ncan never disagree about what an interaction is.","operationId":"getInteraction","parameters":[{"name":"interaction","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InteractionView"}}}},"404":{"description":"No such interaction in this workspace"}},"security":[{"apiKey":[]}]}},"/issues":{"get":{"tags":["detections"],"summary":"The Issues index.","operationId":"listIssues","parameters":[{"name":"f","in":"query","description":"The filter expression, e.g. `all;severity~in~critical;tags~nin~needs review`.\n\nThe first segment is the join (`all` or `any`); each later segment is\n`field~op~values`, with `op` one of `in`, `nin`, `before`, `after` and\nvalues separated by commas. A malformed segment is ignored; a field\nthis list does not have is a 400 naming it.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"Free text over the title, summary, rule, source and subject name. ANDs\nwith the expression whichever way its conditions are joined.","required":false,"schema":{"type":["string","null"]}},{"name":"status","in":"query","required":false,"schema":{"type":["string","null"]}},{"name":"severity","in":"query","required":false,"schema":{"type":["string","null"]}},{"name":"kind","in":"query","required":false,"schema":{"type":["string","null"]}},{"name":"subject_kind","in":"query","required":false,"schema":{"type":["string","null"]}},{"name":"subject_id","in":"query","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","description":"Where the previous page stopped: its `next_cursor`, carried back as\ngiven. Opaque. One that cannot be read starts from the top rather than\nfailing the page — it is a link a browser kept.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Rows on this page. Default 50, clamped to 1..=200.","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssueListResponse"}}}}},"security":[{"apiKey":[]}]}},"/issues/groups":{"get":{"tags":["detections"],"summary":"List issue groups","description":"Issues grouped by what raised them (`by=source`, the default) or by what\nthey are about (`by=subject`), with counts over the whole match rather\nthan a page. Narrowed by `f` and `q` only: `status`, `severity`, `kind`,\n`subject_kind` and `subject_id` are accepted by `GET /issues` but ignored\nhere, so say those in `f` (for example `status~in~open`).","operationId":"listIssueGroups","parameters":[{"name":"f","in":"query","description":"The filter expression, exactly as `listIssues` takes it.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"Free text, exactly as `listIssues` takes it.","required":false,"schema":{"type":["string","null"]}},{"name":"by","in":"query","description":"What to group by: `source` (what raised the issue — a policy, an engine,\na scanner; the default) or `subject` (what it is about). Anything else\nis a 400.","required":false,"schema":{"type":["string","null"]}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssueGroupsResponse"}}}}},"security":[{"apiKey":[]}]}},"/issues/mutes":{"get":{"tags":["detections"],"summary":"Every mute holding in this workspace right now.","description":"Gated on `ViewAlert` and not `TriageAlert`: reading what has been silenced is\nexactly the review this mechanism depends on, and requiring the grant that\n*creates* mutes in order to read them would hide the silencers from everybody\nexcept the people who make them.","operationId":"listIssueMutes","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MuteListResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks alerts:read in this workspace"}},"security":[{"apiKey":[]}]}},"/issues/mutes/{mute}":{"delete":{"tags":["detections"],"summary":"Lift a mute","description":"Lifts a mute before it expires. Answers 204 whether or not the mute was\nstill in force, so lifting twice is not an error. A malformed id is a 404.","operationId":"unmuteIssue","parameters":[{"name":"mute","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Lifted, or there was nothing live to lift"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks alerts:triage in this workspace"}},"security":[{"apiKey":[]}]}},"/issues/{issue}":{"get":{"tags":["detections"],"summary":"One issue","description":"The same fields as a row of `GET /issues`, plus `evidence`. An unknown id,\nanother workspace's, a deleted one, or a string that is not an id at all\nis a 404. A suppressed issue is returned, although the default list hides\nit.","operationId":"getIssue","parameters":[{"name":"issue","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssueView"}}}},"404":{"description":"No such issue in this workspace"}},"security":[{"apiKey":[]}]},"patch":{"tags":["detections"],"summary":"Move an issue through triage.","description":"Gated on `TriageAlert`, not `ViewAlert`: deciding that a condition is dealt\nwith is a different act from reading that it exists, and only one of them\nchanges what the next person sees.","operationId":"triage","parameters":[{"name":"issue","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriageRequest"}}},"required":true},"responses":{"200":{"description":"Triaged"},"400":{"description":"Unknown status"},"404":{"description":"No such issue in this workspace"}},"security":[{"apiKey":[]}]}},"/issues/{issue}/mute":{"post":{"tags":["detections"],"summary":"Mute an issue","description":"Silences the condition the issue groups on: its subject, source and rule.\nNeeds the permission to triage alerts. A reason is required, and\n`expires_at` must be sent, either as a date within 90 days or as `null`\nfor a mute that holds until somebody lifts it.","operationId":"muteIssue","parameters":[{"name":"issue","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MuteRequest"}}},"required":true},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MuteView"}}}},"400":{"description":"No reason, no `expires_at` field, or a date that is past or beyond 90 days"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks alerts:triage in this workspace"},"404":{"description":"No such issue in this workspace"}},"security":[{"apiKey":[]}]}},"/issues/{issue}/tags":{"put":{"tags":["detections"],"summary":"Replace an issue's tags.","description":"Sets the issue's own tags, not those of the artifact or machine it is\nabout.","operationId":"put_issue_tags","parameters":[{"name":"issue","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutTagsRequest"}}},"required":true},"responses":{"200":{"description":"The stored set, after normalisation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TagListResponse"}}}},"400":{"description":"Malformed body, or an entry that is not a tag — the message names it"},"403":{"description":"Caller lacks alerts:read in this workspace"},"404":{"description":"No such issue in this workspace"}},"security":[{"apiKey":[]}]}},"/issues/{issue}/tamper":{"get":{"tags":["detections"],"summary":"Tamper events behind an issue","description":"The tamper events behind a `machine_tamper` issue, newest first, at most\n200. A 404 for an id this workspace does not hold and for an issue that is\nnot `machine_tamper`.","operationId":"getIssueTamper","parameters":[{"name":"issue","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssueTamperView"}}}},"404":{"description":"No such machine_tamper issue in this workspace"}},"security":[{"apiKey":[]}]}},"/machines":{"get":{"tags":["machines"],"summary":"List machines","description":"The workspace's fleet, filtered and paged. Archived and deleted machines\nare left out unless `lifecycle` asks for archived ones. `f`, `q`, `cursor`\nand `limit` work the same way as on the AI artifacts list.","operationId":"list_machines","parameters":[{"name":"f","in":"query","description":"The filter expression, e.g. `all;status~in~healthy;group~nin~lab`.\n\nA malformed segment is dropped; a field this list does not have is a\n400 naming it. Fields: `status`, `os`, `os_version`, `agent_version`,\n`group`, `tactic`, `strategy`, `last_seen`, `enrolled`.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"Free text over hostname, OS, versions, group and machine ID. ANDs with\nthe expression whichever way its conditions are joined.","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","description":"Where the previous page stopped. Opaque; an unreadable one starts over.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Rows wanted: 50 when absent, at most 200. A larger value is answered\nwith 200 rows rather than refused.","required":false,"schema":{"type":["integer","null"],"format":"int64"}},{"name":"lifecycle","in":"query","description":"`active | suspended | stuck | uninstalled | archived`. `stuck` includes\nmachines still installing. Absent lists every machine that is neither\narchived nor deleted; a deleted one is never listed.","required":false,"schema":{"type":["string","null"]}}],"responses":{"200":{"description":"Enrolled machines in this workspace","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMachinesResponse"}}}},"400":{"description":"The filter names a field this surface does not have"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/machines/names":{"get":{"tags":["machines"],"summary":"Machine names","description":"Every live machine's ID and hostname, in one response: a lookup for\nturning machine IDs into names. It takes no filter and is not paged, so\nthe answer is always complete. Needs the same permission as the machines\nlist.","operationId":"list_machine_names","responses":{"200":{"description":"Every live machine's id and hostname","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMachineNamesResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}":{"get":{"tags":["machines"],"summary":"One machine and its counts, for the machine details page.","description":"**A machine in another workspace is a 404, never a 403.** A 403 would confirm\nthat the id exists, which is a cross-workspace existence oracle: machine ids\nare not secrets, and an attacker who can tell \"not yours\" from \"no such\nthing\" can enumerate another workspace's fleet through this endpoint. The\nartifacts and scans reads refuse the same way, and so does the `PATCH` on\nthis path.\n\nAn unparseable id is a 404 too, and not a 400: it is a stale or hand-edited\nlink, and the recovery is the same one — go back to the list.","operationId":"get_machine","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The machine and its counts","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineDetailView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such machine in this workspace"}},"security":[{"apiKey":[]}]},"patch":{"tags":["machines"],"summary":"Reconfigure a machine.","operationId":"update_machine","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateMachineRequest"}}},"required":true},"responses":{"200":{"description":"Updated machine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineView"}}}},"400":{"description":"Request carried a capture_tactic field, or a scan setting outside its bounds"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such machine in this workspace"},"409":{"description":"The machine is deleted or uninstalled"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/activity":{"get":{"tags":["machines"],"summary":"Per-day interaction and decision counts for one machine.","description":"Gated on `machines:read`, exactly as the interactions list itself is — this\nis a rollup of rows that grant already reads, and a stricter gate here\nwould hide a count of things the caller may list one by one.\n\nA machine in another workspace is a 404, never a 403 — `get_machine`'s\nexistence-oracle reasoning.","operationId":"getMachineActivity","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"days","in":"query","description":"Trailing window, in UTC days. Default 30, clamped to 1..=90.","required":false,"schema":{"type":["integer","null"],"format":"int32"}}],"responses":{"200":{"description":"Per-day counts, oldest first, zero-filled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineActivityResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such machine in this workspace"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/addresses":{"get":{"tags":["machines"],"summary":"A machine's address history","description":"Every retained address change for one machine, both kinds, newest first.\nAt most 50 changes of each kind are kept, and all of them are returned:\nthere is no paging. Needs permission to read machines.\n\n**Personal data.** A machine in another workspace, or an ID that cannot\nbe read, is a 404. A machine whose address has never changed answers 200\nwith two empty lists.","operationId":"listMachineAddresses","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Both kinds' retained changes, newest first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineAddressesResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such machine in this workspace"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/collection":{"get":{"tags":["machines"],"summary":"A machine's content collection queue","description":"The file contents requested from this machine: counts by state and up to\n200 requests, newest first. A machine in another workspace is a 404.","operationId":"getMachineCollection","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"This machine's tracked content queue","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineCollectionResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such machine in this workspace"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/commands":{"get":{"tags":["machines"],"summary":"List a machine's recent commands","description":"The latest 20 commands sent to this machine, newest first, and what its\nagent said happened.","operationId":"list_machine_commands","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Recent commands, newest first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandListResponse"}}}},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such machine in this workspace"}},"security":[{"apiKey":[]}]},"post":{"tags":["machines"],"summary":"Queue a command for a machine.","description":"The machine picks the command up when it next checks in. A command that is\nnot picked up before its kind's expiry, or that the machine receives\nseveral times without answering, is dropped.","operationId":"send_command","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SendCommandRequest"}}},"required":true},"responses":{"202":{"description":"Command queued","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SendCommandResponse"}}}},"400":{"description":"Unknown command kind"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such machine in this workspace"},"409":{"description":"A retired kind (`retired_kind`), or a deleted or uninstalled machine"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/connections":{"get":{"tags":["machines"],"summary":"A machine's AI connections","description":"The tools on this machine that talked to AI services, and the services they\ntalked to, over a recent window. A machine in another workspace, or a\ndeleted one, is a 404.","operationId":"getMachineConnections","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"hours","in":"query","description":"Trailing window, in hours. Default 24, clamped to 1..=168.","required":false,"schema":{"type":["integer","null"],"format":"int32"}}],"responses":{"200":{"description":"Tools and services, largest first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineConnectionsResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such machine in this workspace, or it was deleted"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/coverage":{"get":{"tags":["activity"],"summary":"Uncovered traffic from a machine","description":"What this machine sent that no capture rule covers. Use it\nto tell a quiet machine from one whose traffic is going somewhere Oxelone\ndoes not record, such as a vendor's renamed endpoint. Metadata only; it\nneeds the same permission as reading machines, not content access. A\nmachine in another workspace, or a malformed id, is a 404; a machine\nwhose traffic is fully covered returns `200` with an empty list.","operationId":"coverage","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Endpoints no rule covers, newest activity first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CoverageResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such machine in this workspace"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/delete":{"post":{"tags":["machines"],"summary":"Delete a machine","description":"Final. The machine leaves every list, and if its agent comes back online it\nis told it was deleted and removes itself. An Active machine cannot be\ndeleted (409 `not_deletable`).","operationId":"delete_machine","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Deleted"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such machine in this workspace"},"409":{"description":"`not_deletable` (an Active machine) or `deleted`"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/diagnostics":{"get":{"tags":["machines"],"summary":"List a machine's diagnostic bundles","description":"Newest first, without log tails. Needs permission to manage the fleet,\nbecause a bundle answers a command only a fleet manager can send.","operationId":"list_diagnostics","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"f","in":"query","description":"The filter expression, e.g. `all;truncated~in~true;error~nin~none`.\n\nFields: `agent_version`, `bundle_hash`, `truncated`, `error`,\n`collected`, `received`. **The machine is not one of them**: it is the\npath, not a condition, which is what makes this tab's locked chip a\nstatement of the surface rather than a filter a reader could clear.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"Free text over the agent version, the bundle hash and the error kind.\nNever the log tail — this route does not serve one.","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","description":"Where the previous page stopped. Opaque; an unreadable one starts over.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Rows wanted: 50 when absent, between 1 and 200.","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"Stored bundles, newest first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListDiagnosticsResponse"}}}},"400":{"description":"The filter names a field this surface does not have"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such machine in this workspace"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/diagnostics/{id}":{"get":{"tags":["machines"],"summary":"One diagnostic bundle","description":"The bundle in full, log tail included. Needs permission to manage the\nfleet. Each read is recorded in the audit log; listing bundles is not.","operationId":"get_diagnostics","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The bundle","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DiagnosticsView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such bundle for this machine in this workspace"}},"security":[{"apiKey":[]}]},"delete":{"tags":["machines"],"summary":"Delete a diagnostic bundle","description":"Removes the bundle for good, not just from view, and records the deletion\nin the audit log. Needs the `fleet:manage` permission. A 404 when the\nbundle is not this machine's or the machine is not in this workspace.\nDeleting a bundle does not ask the machine for a new one.","operationId":"delete_diagnostics","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"The bundle no longer exists on the server"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such bundle for this machine in this workspace"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/elevation-grants":{"get":{"tags":["machines"],"summary":"List a machine's elevation grants","description":"Newest first, with each grant's state: `live`, `revoked` or `expired`.\nNeeds permission to manage the fleet.","operationId":"listElevationGrants","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"This machine's grants, newest first","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/GrantView"}}}}},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such machine in this workspace"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/resume":{"post":{"tags":["machines"],"summary":"Resume a suspended machine","description":"The machine's agent sets itself up again on its next check-in.","operationId":"resume_machine","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Resumed"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such machine in this workspace"},"409":{"description":"`not_suspended`, `uninstalled` or `deleted`"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/strategies/{strategy}":{"patch":{"tags":["machines"],"summary":"Turn one of a machine's strategies on or off.","description":"The set of strategies a machine enrolled with never changes; this only\ndecides which of them are running. A strategy the machine did not enroll\nwith is a 400, not an addition.","operationId":"set_machine_strategy","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"strategy","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetStrategyEnabledRequest"}}},"required":true},"responses":{"200":{"description":"Updated machine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineView"}}}},"400":{"description":"Unknown strategy, or one this machine did not enrol with"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such machine in this workspace"},"409":{"description":"The machine is deleted or uninstalled"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/suspend":{"post":{"tags":["machines"],"summary":"Suspend a machine","description":"On its next check-in the machine's agent puts back what it changed and\nstands down, still checking in every five minutes. Reversible with Resume.","operationId":"suspend_machine","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Suspended"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such machine in this workspace"},"409":{"description":"`already_suspended`, `uninstalled`, `archived` or `deleted`"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/timeline":{"get":{"tags":["machines"],"summary":"A machine's history","description":"Newest first: the audit records that name the machine, each command's\nqueued, delivered and answered stages, and what the machine itself\nreported. Needs permission to manage the fleet.","operationId":"get_machine_timeline","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"before","in":"query","description":"`next_before` from the previous page.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"1–200; default 50.","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"The machine's history, newest first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TimelineResponse"}}}},"400":{"description":"`before` is not a cursor this route issued"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such machine in this workspace"}},"security":[{"apiKey":[]}]}},"/machines/{machine_id}/updates":{"get":{"tags":["machines"],"summary":"A machine's updates, newest first.","operationId":"listMachineUpdates","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Updates, newest first","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/MachineUpdateHistoryView"}}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such machine in this workspace"}},"security":[{"apiKey":[]}]},"post":{"tags":["machines"],"summary":"Update one machine to the default build.","operationId":"startMachineUpdate","parameters":[{"name":"machine_id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StartUpdateRequest"}}},"required":true},"responses":{"201":{"description":"The rollout","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolloutView"}}}},"400":{"description":"max_retries outside 0–5"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks fleet:manage in this workspace"},"404":{"description":"No such live machine in this workspace"},"409":{"description":"The machine is not behind the default, or no release is published"}},"security":[{"apiKey":[]}]}},"/overview":{"get":{"tags":["overview"],"summary":"Workspace overview","description":"The workspace's posture over the trailing window: totals, a per-day series,\nthe services and tools that carried AI traffic, and the issue mix. Counts\nand names only, never content: no prompt text, preview or attachment name.\nNeeds the same permission as reading machines and interactions.","operationId":"getWorkspaceOverview","parameters":[{"name":"days","in":"query","description":"Trailing window, in UTC days. Default 30, clamped to 1..=90.","required":false,"schema":{"type":["integer","null"],"format":"int32"}}],"responses":{"200":{"description":"The workspace's posture over the window","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceOverviewResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"}},"security":[{"apiKey":[]}]}},"/people":{"get":{"tags":["accounts"],"summary":"The Accounts index.","operationId":"listPeople","parameters":[{"name":"f","in":"query","description":"The filter expression, e.g. `all;source~in~connector;enterprise~nin~personal`.\n\nThe first segment is the join (`all` or `any`); each later segment is\n`field~op~values`, with `op` one of `in`, `nin`, `before`, `after` and\nvalues separated by commas. A malformed segment is ignored; a field\nthis list does not have is a 400 naming it.","required":false,"schema":{"type":["string","null"]}},{"name":"q","in":"query","description":"Free text over the display and the presences' addresses and logins.\nANDs with `f` whichever way its conditions are joined.","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","description":"Where the previous page stopped. Opaque; an unreadable one starts over.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Rows wanted. At most 200.","required":false,"schema":{"type":["integer","null"],"format":"int64"}},{"name":"group","in":"query","description":"`flat`, `domain` or `enterprise` — an order and a label, never a fold.\nAn unknown value is a 400 naming the three, for the reason an unknown\nfilter field is.","required":false,"schema":{"type":["string","null"]}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PersonListResponse"}}}},"400":{"description":"A filter field this surface does not have, or an unknown `group`"}},"security":[{"apiKey":[]}]}},"/people/{id}":{"get":{"tags":["accounts"],"summary":"One person, every presence in full.","operationId":"getPerson","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PersonView"}}}},"404":{"description":"No such person in this workspace"}},"security":[{"apiKey":[]}]}},"/people/{id}/history":{"get":{"tags":["accounts"],"summary":"One person's history","description":"What happened to one person, newest first: connector actions, events,\ninteractions and issues merged into one list. A 404 for a person this\nworkspace does not hold.","operationId":"getPersonHistory","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"cursor","in":"query","description":"Where the previous page stopped. Opaque; an unreadable one starts over.","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Items wanted. At most 200.","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HistoryView"}}}},"404":{"description":"No such person in this workspace"}},"security":[{"apiKey":[]}]}},"/people/{id}/presences/{presence}/actions":{"post":{"tags":["inventory"],"summary":"Run a connector action on a presence","description":"Runs one connector action, such as removing a member, against the record\nthis presence names in the connected service. It applies the same checks\nand refusals as running the action from the connection: the connection is\nlive, the connector offers the action for this kind of record, and the\nrecord is reachable. A vendor's refusal is returned as is, never retried.\nNeeds the permission to manage connections. Only a presence that came from\na connector has actions; a tool or machine presence is refused. The\nattempt appears in the person's history.","operationId":"runPresenceAction","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"presence","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PresenceActionInput"}}},"required":true},"responses":{"201":{"description":"The action that was performed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectionActionView"}}}},"400":{"description":"No such action, or it does not act on this presence's record kind"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks connections:manage in this workspace"},"404":{"description":"No such person or presence in this workspace, or no such record"},"409":{"description":"This presence has no actions; or the connection is not live, cannot reach that action, or the connector declined"},"502":{"description":"The vendor could not be reached"},"503":{"description":"The vendor is rate-limiting this account"}},"security":[{"apiKey":[]}]}},"/policies":{"get":{"tags":["policies"],"summary":"List policies","description":"Every policy in this workspace, at its current version, or with\n`?connection=` only the rules bound to that connection.","operationId":"listPolicies","parameters":[{"name":"connection","in":"query","description":"A connection id: only that connection's rules, in precedence order.\n\nAn id that is not a connection in this workspace, cannot be parsed, or\nwas removed is a 404, never an empty list.","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Policies in this workspace","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListPoliciesResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"},"404":{"description":"No such workspace, no such connection, or the caller is not a member"}},"security":[{"apiKey":[]}]},"post":{"tags":["policies"],"summary":"Create a policy","description":"The policy starts Disabled (`draft`) unless `mode` says otherwise.\n`enforce` needs `policies:publish`, as `/mode` does; `monitor` and `enforce`\nare checked as enabling a Disabled policy is, and `monitor` needs a policy\nthat can hold something back. A policy that starts in Monitor or Enabled\nships at once, and the reply carries what that publish did under `publish`\n— `null` for a Disabled policy — beside the policy's own fields, `mode`\namong them.","operationId":"createPolicy","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatePolicyInput"}}},"required":true},"responses":{"201":{"description":"Policy created: the policy as stored, plus `holds_back` and `publish` (the auto-publish's `{hash, warnings, halted}`, `null` for a draft)","content":{"application/json":{"schema":{}}}},"400":{"description":"Policy body is malformed or fails validation, an unknown mode, or Monitor on a policy that holds nothing back"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write in this workspace, or policies:publish for enforce"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policies/compile":{"post":{"tags":["policies"],"summary":"Compile and publish policies","description":"Compiles every policy that is not Disabled, together with the PII & Secrets\nrules and the workspace's catalogued services, and publishes\nthe result as what every machine in the workspace runs next. While\nenforcement is halted, every policy is published as Monitor; the stored\nstates are untouched.","operationId":"compile","responses":{"201":{"description":"Compiled and published as the workspace's current bundle","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompileResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:publish in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policies/enforcement":{"get":{"tags":["policies"],"summary":"Enforcement state","description":"What is enforcing in this workspace, and on how many machines: whether\nenforcement is halted, and how far the current publish has reached.","operationId":"getPolicyEnforcementState","responses":{"200":{"description":"Halt state and bundle rollout","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnforcementStateView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policies/enforcement/halt":{"post":{"tags":["policies"],"summary":"Halt enforcement","description":"Stops enforcing everything in this workspace without changing a single\npolicy: every policy runs as Monitor, and alerts are still raised. Takes\neffect at once — the policies are republished in the same request, and if\nthat fails the whole request fails, so a success means the machines are\nbeing told. Needs `policies:publish` and a `reason`, which is recorded.","operationId":"haltPolicyEnforcement","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HaltRequest"}}},"required":true},"responses":{"200":{"description":"Enforcement halted and a bundle republished","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnforcementStateView"}}}},"400":{"description":"No reason was given"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:publish in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policies/enforcement/resume":{"post":{"tags":["policies"],"summary":"Resume enforcement","description":"Lets enforcement resume after a halt. Every policy returns to whatever its\nstate already said, because the halt never changed it.","operationId":"resumePolicyEnforcement","responses":{"200":{"description":"Enforcement resumed and a bundle republished","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnforcementStateView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:publish in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policies/layout":{"get":{"tags":["policies"],"summary":"A tab's top level, in order.","operationId":"getPolicyLayout","parameters":[{"name":"subject","in":"query","description":"The tab: a policy type's wire value — `prompt`, `file_artifact`, `hook`,\n`connector_event`, …","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The tab's groups and policies in no group, in order","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyLayoutView"}}}},"400":{"description":"Unknown policy type"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]},"put":{"tags":["policies"],"summary":"Replace a tab's top-level order.","description":"Refuses an item that is not on the tab — another workspace's, another type's,\nor a policy that is in a group (it moves within its group) — and a list that is\nnot the tab's whole top level (409: it changed since it was read, the rule\n`PUT /policies/order` has for a partial list). Reading order only, like that\nroute; it republishes because the bundle's policy order follows precedence.","operationId":"setPolicyLayout","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetLayoutRequest"}}},"required":true},"responses":{"200":{"description":"The layout as stored","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyLayoutView"}}}},"400":{"description":"Unknown type or kind, a malformed or repeated id, an id that is not this workspace's, an item of another type, or a policy that is in a group"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"},"409":{"description":"The list is not the tab's whole top level: it changed since it was read"}},"security":[{"apiKey":[]}]}},"/policies/modes":{"put":{"tags":["policies"],"summary":"Set the state of many policies","description":"One transaction and one publish. Each id is checked as\n`POST /policies/{id}/mode` checks it — leaving Disabled re-validates against\nthis workspace's engines and connections, and a connector's rule is refused\nbecause it is switched per connection — and a refused id is reported and\nleft as it was while the rest are written together. A policy whose group is\nOff has its stored state written like any other; it stays paused until its\ngroup is On.\n\nNeeds `policies:write`, and `policies:publish` as well when the mode is\n`enforce`.","operationId":"setPolicyModes","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetModesRequest"}}},"required":true},"responses":{"200":{"description":"Each id's outcome, and the one publish","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetModesResponse"}}}},"400":{"description":"Unknown mode, a malformed or repeated id, or more than 500 ids"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write, or policies:publish for enforce"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policies/order":{"put":{"tags":["policies"],"summary":"Reorder policies","description":"Sets the order one policy type's list is read in, and nothing else. It does\nnot make the first matching policy win: every policy is evaluated and every\nmatch raises its own alert.\n\nThe list must name every policy of that type in this workspace; a partial\nlist is refused with a 400 that gives the expected count. Needs\n`policies:write`. Reordering publishes nothing and reaches no machine.","operationId":"setPolicyOrder","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOrderRequest"}}},"required":true},"responses":{"200":{"description":"Order stored","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOrderResponse"}}}},"400":{"description":"Unknown policy type, an id that is not this workspace's, an id of another type, or an incomplete list"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policies/removed":{"get":{"tags":["policies"],"summary":"List removed policies","description":"The policies provided by Oxelone that this workspace removed. Each can be\nbrought back with `POST /policies/{id}/restore`.","operationId":"listRemovedVendorPolicies","responses":{"200":{"description":"The policies provided by Oxelone that this workspace removed, restorable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListRemovedResponse"}}}},"403":{"description":"Caller lacks policies:read in this workspace"}},"security":[{"apiKey":[]}]}},"/policies/simulate":{"post":{"tags":["policies"],"summary":"Simulate one call against this workspace's policies.","operationId":"simulatePolicies","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SimulateRequest"}}},"required":true},"responses":{"200":{"description":"The winner, the route, and every policy of the trigger with its result","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SimulateResponse"}}}},"400":{"description":"Unknown trigger, tool or action, or a draft that would not save"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policies/tool-config-preview":{"post":{"tags":["policies"],"summary":"Preview an AI tool policy","description":"How many of this workspace's machines an unsaved AI tool policy would match now.","operationId":"previewToolConfigPolicy","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ToolConfigPreviewRequest"}}},"required":true},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ToolConfigPreviewView"}}}},"400":{"description":"Not a Host policy about an AI tool, triggered while present"},"403":{"description":"Caller lacks policies:write or machines:read in this workspace"}},"security":[{"apiKey":[]}]}},"/policies/validate":{"post":{"tags":["policies"],"summary":"Validate a policy body","description":"Checks a policy body as saving it would, and says whether it could be\nenabled and, if not, why — without storing anything. Needs\n`policies:write`; it does not need `policies:publish`, so an author learns\nwhy a rule cannot be enabled before asking someone who can enable it.","operationId":"validatePolicy","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyInput"}}},"required":true},"responses":{"200":{"description":"The verdict, whichever way it went","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyValidationView"}}}},"400":{"description":"The body is not a JSON object at all"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policies/{id}":{"put":{"tags":["policies"],"summary":"Publish a new version of an existing policy.","description":"The live `mode` is preserved from the existing policy, never taken from\nthe request body — see the `PolicyInput` doc comment. Changing mode is\nexclusively `POST .../mode`'s job.","operationId":"updatePolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyInput"}}},"required":true},"responses":{"200":{"description":"New version published, and auto-published unless the policy is Disabled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyWriteView"}}}},"400":{"description":"Policy body is malformed or fails validation, or an ENABLED policy's edit would leave it unarmable"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write in this workspace"},"404":{"description":"No such policy in this workspace"}},"security":[{"apiKey":[]}]},"delete":{"tags":["policies"],"summary":"Delete a policy","description":"The policy leaves the list and stops running on every machine; the policies\nare republished in the same request. Its version history is kept, so\nalerts it raised still name the exact rule that fired.\n\n`policies:write` deletes a Disabled or Monitor policy; deleting an Enabled\none also needs `policies:publish`, because it stops live enforcement. An\nunknown id, or one in another workspace, is a 404.","operationId":"deletePolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Policy soft-deleted and the bundle republished in the same request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompileResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks the grant this delete requires — policies:write, or policies:publish for an enforcing policy"},"404":{"description":"No such policy in this workspace"}},"security":[{"apiKey":[]}]}},"/policies/{id}/activity":{"get":{"tags":["policies"],"summary":"One policy's activity","description":"One policy's decisions over a window, with the engines and tools behind\nthem. Works for the workspace's own policies and provided ones.","operationId":"getPolicyActivity","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"window","in":"query","description":"`24h`, `7d` or `30d`. Defaults to `30d`.","required":false,"schema":{"type":["string","null"]}}],"responses":{"200":{"description":"The policy's decisions, engines and tools over the window","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyActivity"}}}},"400":{"description":"The window is not one of 24h, 7d, 30d"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"},"404":{"description":"No such policy in this workspace, and no such provided policy"}},"security":[{"apiKey":[]}]}},"/policies/{id}/duplicate":{"post":{"tags":["policies"],"summary":"Duplicate a provided policy","description":"Copies a policy provided by Oxelone into one this workspace owns and can\nedit. The copy starts Disabled. Needs `policies:write`.","operationId":"duplicateVendorPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DuplicateRequest"}}},"required":true},"responses":{"201":{"description":"A policy this workspace owns, Disabled, with the provided policy's content","content":{"application/json":{"schema":{}}}},"403":{"description":"Caller lacks policies:write in this workspace"},"404":{"description":"No such policy provided by Oxelone"}},"security":[{"apiKey":[]}]}},"/policies/{id}/hits":{"get":{"tags":["policies"],"summary":"A policy's hit counts","description":"How often this policy's filter has matched: every decision it produced, in\nevery state and with every outcome, in total and over the trailing 30 days.\nBroader than the preview on purpose: the preview counts only Monitor, while\nthis answers whether the rule is doing anything at all.","operationId":"getPolicyHits","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Total decisions, and the trailing 30 days","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyHitsView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"},"404":{"description":"No such policy in this workspace"}},"security":[{"apiKey":[]}]}},"/policies/{id}/mode":{"post":{"tags":["policies"],"summary":"Set a policy's state","description":"Moves a policy between Disabled (`draft`), Monitor (`monitor`) and Enabled\n(`enforce`), and republishes in the same request. Needs `policies:write`;\nreaching `enforce` also needs `policies:publish`. Every change is recorded\nin the audit log, so you can later tell whether a policy was enforcing when\nan alert was raised.","operationId":"set_mode","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetModeRequest"}}},"required":true},"responses":{"200":{"description":"Mode changed, and the bundle republished in the same request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyWriteView"}}}},"400":{"description":"Unknown mode"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks the grant this transition requires"},"404":{"description":"No such policy in this workspace"}},"security":[{"apiKey":[]}]}},"/policies/{id}/preview":{"get":{"tags":["policies"],"summary":"Preview a policy","description":"What this policy would have done had it been Enabled, from what it matched\nwhile in Monitor. Every count is scoped to Monitor: a decision made while\nthe policy was already Enabled is not evidence about enabling it. Needs\n`policies:read`.\n\nAn empty answer is not a safe answer: a policy put in Monitor minutes ago\nand one that genuinely matches nothing produce identical counts, which is\nwhat `first_at` tells apart.","operationId":"previewPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"days","in":"query","description":"Whole days, 1–90. Defaults to 7. 90 days is also the longest a\nworkspace can keep engine runs.","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"What arming this policy would have changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BlastRadiusView"}}}},"400":{"description":"The window is out of range, or the id is reserved"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"},"404":{"description":"No such policy in this workspace, or a provided policy it cannot preview"}},"security":[{"apiKey":[]}]}},"/policies/{id}/restore":{"post":{"tags":["policies"],"summary":"Restore a removed policy","description":"Brings back a policy provided by Oxelone that this workspace removed, in\nthe state it had, and republishes. Needs `policies:write`; restoring one\nthat was Enabled also needs `policies:publish`, because it starts\nenforcing again.","operationId":"restoreVendorPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Back in this workspace's list, in the state it had","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyWriteView"}}}},"403":{"description":"Caller lacks policies:write in this workspace"},"404":{"description":"Not a policy provided by Oxelone that this workspace removed"}},"security":[{"apiKey":[]}]}},"/policy-capabilities":{"get":{"tags":["policies"],"summary":"What a policy type can do","description":"For one policy type, every filter field, comparison, engine, input and\nresponse a policy may use in this workspace, with how many machines can\nact on a filter field or a response today.","operationId":"getPolicyCapabilities","parameters":[{"name":"subject","in":"query","description":"The policy type: `prompt`, `file_artifact`, `asset`, `connector_event`,\nor `egress`. Required; missing or unknown is a 400.","required":false,"schema":{"type":["string","null"]}},{"name":"connection","in":"query","description":"Which connection the catalogue is for. Meaningful only with\n`subject=connector_event`; ignored for every other type.","required":false,"schema":{"type":["string","null"]}},{"name":"connector","in":"query","description":"Which connector the catalogue is for.\n\n**The platform document's narrowing**, and the one it needs: a vendor\npolicy is written for one connector (`vendor_policies.connector`), and\nwithout this the document lists every live connector's record kinds in\none list. On a **workspace** document the connection already names its\nconnector, so this is only a cross-check: sending both and disagreeing\nis a 400, and sending it alone is ignored.","required":false,"schema":{"type":["string","null"]}},{"name":"action","in":"query","description":"The Hook trigger's action kind (`shell`, `file_read`, …): narrows\n`predicates` and `actions` to what a policy on that action offers.\nMeaningful only with `subject=hook`; ignored elsewhere, like\n`connection`. An unknown word is a 400 that names the eight.","required":false,"schema":{"type":["string","null"]}}],"responses":{"200":{"description":"What this workspace can do with this policy type","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyCapabilitiesView"}}}},"400":{"description":"The policy type is missing or unknown"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:read in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policy-groups":{"post":{"tags":["policies"],"summary":"Create a group of this workspace's own policies.","operationId":"createPolicyGroup","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateGroupRequest"}}},"required":true},"responses":{"201":{"description":"The group as stored, On","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupView"}}}},"400":{"description":"Unknown type, a blank name, or a policy that may not be a member: not this workspace's, provided, of another type, or already in a group"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policy-groups/order":{"put":{"tags":["policies"],"summary":"Reorder policy groups","description":"Sets the order one policy type's groups are read in. It changes nothing a\nmachine runs.","operationId":"setPolicyGroupOrder","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetGroupOrderRequest"}}},"required":true},"responses":{"200":{"description":"Order stored","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetGroupOrderResponse"}}}},"400":{"description":"Unknown type, an id that is not one of this workspace's groups, a group of another type, a duplicate, or an incomplete list"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/policy-groups/{id}":{"put":{"tags":["policies"],"summary":"Update a policy group","description":"Rename, describe, or set the members of one of this workspace's own groups.","operationId":"updatePolicyGroup","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateGroupRequest"}}},"required":true},"responses":{"200":{"description":"The group as stored; the bundle republished when an Off group's members changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupWriteView"}}}},"400":{"description":"A blank name, or a policy that may not be a member"},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write — or policies:publish, when the change takes an Enabled policy out of an Off group"},"404":{"description":"No such group in this workspace"},"409":{"description":"The group is provided by Oxelone; its content cannot be edited here"}},"security":[{"apiKey":[]}]},"delete":{"tags":["policies"],"summary":"Delete or remove a policy group","description":"Deletes one of this workspace's own groups (its policies stay, in no\ngroup), or removes a group provided by Oxelone and its policies from this\nworkspace; a removed provided group can be restored.","operationId":"deletePolicyGroup","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Deleted, or removed for this workspace; the bundle republished when what runs changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupDeleteView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write — or policies:publish, when deleting an Off group resumes an Enabled policy"},"404":{"description":"No such group in this workspace, or a provided group it already removed"},"409":{"description":"A Connector group: its rules are switched on each connection, not by the group"}},"security":[{"apiKey":[]}]}},"/policy-groups/{id}/restore":{"post":{"tags":["policies"],"summary":"Restore a provided policy group","description":"Brings back a group provided by Oxelone that this workspace removed, with\nits policies, each in the state it had.","operationId":"restorePolicyGroup","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Restored with its policies; the bundle republished","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupWriteView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write in this workspace, or policies:publish when an Enabled policy of an On group would start enforcing"},"404":{"description":"Not a provided group this workspace removed"}},"security":[{"apiKey":[]}]}},"/policy-groups/{id}/state":{"put":{"tags":["policies"],"summary":"Turn a policy group On or Off","description":"Off pauses every member: each reads as Disabled and keeps its own state.\nOn restores each as it was set.","operationId":"setPolicyGroupState","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetGroupStateRequest"}}},"required":true},"responses":{"200":{"description":"Switched, and the bundle republished in the same request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupWriteView"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks policies:write — or policies:publish, to switch on a group holding an Enabled policy"},"404":{"description":"No such group in this workspace, or a provided group it removed"},"409":{"description":"A Connector group: its rules are switched on each connection, not by the group"}},"security":[{"apiKey":[]}]}},"/posture":{"get":{"tags":["posture"],"summary":"The workspace's posture: every shipped check, by AI risk.","description":"Needs `alerts:read`, since every number is a count of issues. Connector\nsources also need `connections:read`, and the machines source\n`machines:read`. A source the caller cannot read is left out and named in\n`withheld`; a caller who can read neither gets a 403.","operationId":"getWorkspacePosture","responses":{"200":{"description":"Every shipped check, with its state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostureResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks alerts:read, or both connections:read and machines:read"}},"security":[{"apiKey":[]}]}},"/scans":{"get":{"tags":["activity"],"summary":"The Scans surface.","operationId":"listScans","parameters":[{"name":"f","in":"query","description":"The filter expression. Fields: `kind`, `outcome`, `machine`, `at`.","required":false,"schema":{"type":["string","null"]}},{"name":"cursor","in":"query","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","required":false,"schema":{"type":["integer","null"],"format":"int64"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScanRunListResponse"}}}}},"security":[{"apiKey":[]}]}},"/scans/{scan}":{"get":{"tags":["activity"],"summary":"One scan run, for the drawer.","operationId":"getScan","parameters":[{"name":"scan","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScanRunView"}}}},"404":{"description":"No such scan in this workspace"}},"security":[{"apiKey":[]}]}},"/tags":{"get":{"tags":["inventory"],"summary":"List tags","description":"Every tag in use in this workspace, most-used first.","operationId":"listTags","responses":{"200":{"description":"Tags in use, most-used first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TagSuggestionListResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller may read neither artifacts nor issues in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}},"/usage":{"get":{"tags":["observations"],"summary":"Which AI services this workspace is actually using.","description":"Built from metadata alone, so it needs no content capture. Every row says\nwhether an enabled catalog entry covers the service; the\n`catalogued: false` rows are the workspace's Shadow AI.","operationId":"usage","parameters":[{"name":"days","in":"query","description":"How far back to look. Defaults to 7 days.","required":false,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"Service usage in this workspace","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UsageResponse"}}}},"401":{"description":"No valid session"},"403":{"description":"Caller lacks machines:read in this workspace"},"404":{"description":"No such workspace, or the caller is not a member"}},"security":[{"apiKey":[]}]}}},"components":{"schemas":{"ActionCapabilityView":{"type":"object","description":"One action verb, and whether this workspace can actually run it.","required":["verb","channel","available","machines_covered","config_fields"],"properties":{"available":{"type":"boolean","description":"Whether Oxelone can run this verb in this workspace: a connector exists\nfor it, the subject carries a live request to act on, or a destination\nis stored. It does not depend on how many machines are enrolled."},"channel":{"type":"string","description":"Where the verb runs, derived from the verb: `inline` for an enforcing\nverb, `connector` for a connector verb, otherwise `server_async`."},"config_fields":{"type":"array","items":{"type":"string"},"description":"The configuration keys this verb takes, in display order — for `ask`,\n`message` and `require_reason`."},"machines_covered":{"type":"integer","format":"int64","description":"How many of this workspace's machines this verb would act on today.\n\n**Zero is a normal answer.** It is the coverage strip's sentence — *fires\non 0 of your machines today* — and not a reason to hide a verb; an author\ncan write a real policy before enrolling anything, and that is the case\nthis field exists for.\n\nPer verb rather than one number for the document, because the verbs\ngenuinely differ and the differences are the interesting part: `block`\ncounts machines whose capture sits in the request path, `redact` counts\nthe narrower set whose capture reads a body at all, and `alert` counts\nevery live machine because a server-side alarm needs nothing from the\nendpoint. A single count would be wrong for `redact` on a metadata fleet,\nwhich is the one sentence the whole coverage strip exists to say."},"unavailable_reason":{"type":["string","null"],"description":"Why this verb is unavailable, as a full sentence. Present exactly when\n`available` is false."},"verb":{"type":"string"}}},"ActivityDayView":{"type":"object","description":"One UTC day. Days are UTC because every stored instant is — a per-viewer\ntimezone would make two operators' charts disagree about which day a\nmidnight interaction belongs to.","required":["day","interactions","passed","alerted","blocked","undetermined","justified","alerts"],"properties":{"alerted":{"type":"integer","format":"int64"},"alerts":{"type":"integer","format":"int64","description":"Decisions that were alerts that day: raised by a policy's Alert action\nor by a justified override. Not an outcome: a Block with Alert is\ncounted in `blocked` and here; a match with no Alert action is\n`alerted` and not here."},"blocked":{"type":"integer","format":"int64"},"day":{"type":"string","description":"`YYYY-MM-DD`."},"interactions":{"type":"integer","format":"int64","description":"Interactions observed on this machine that day."},"justified":{"type":"integer","format":"int64"},"passed":{"type":"integer","format":"int64"},"undetermined":{"type":"integer","format":"int64"}}},"ActivityEngine":{"type":"object","required":["engine_id","runs","errors"],"properties":{"engine_id":{"type":"string"},"errors":{"type":"integer","format":"int64"},"p95_ms":{"type":["number","null"],"format":"double"},"runs":{"type":"integer","format":"int64"}}},"ActivityOutcomeSeries":{"type":"object","required":["outcome","counts"],"properties":{"counts":{"type":"array","items":{"type":"integer","format":"int64"},"description":"Aligned with `bucket_starts`."},"outcome":{"type":"string"}}},"ActivityTool":{"type":"object","required":["tool","share"],"properties":{"share":{"type":"number","format":"double","description":"0–1, of `decisions`."},"tool":{"type":"string"}}},"AddressChangeView":{"type":"object","description":"One recorded change of one address.\n\n`previous_address` is null on the first address of its kind: the machine\nreporting where it is for the first time, not a move. Whether the change\nis reported or observed is given by the list it appears in.","required":["address","changed_at","private"],"properties":{"address":{"type":"string","description":"The address it changed **to**, bare — never with a `/32` suffix."},"changed_at":{"type":"string","description":"RFC 3339. The API states instants and never pre-formats them."},"country":{"type":["string","null"],"description":"The ISO 3166-1 alpha-2 country of `address`, looked up on the server\nitself: no address is sent anywhere to be located. Null for every\nprivate address and for a public one the lookup does not cover;\n`private` tells the two apart."},"previous_address":{"type":["string","null"],"description":"What it replaced, or null when this is the first of its kind."},"private":{"type":"boolean","description":"True when `address` is private, loopback, link-local, CGNAT or\notherwise non-global — a network inside somebody's walls, about which\nno country claim would be honest."}}},"AdvisoryView":{"type":"object","required":["id","aliases","summary","severity","may_apply"],"properties":{"aliases":{"type":"array","items":{"type":"string"}},"cvss_score":{"type":["number","null"],"format":"float"},"dismissed":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DismissalView"}]},"fixed_in":{"type":["string","null"]},"id":{"type":"string"},"link":{"type":["string","null"]},"may_apply":{"type":"boolean","description":"No resolved version, and the declared range overlaps (or could not be\nread): *may apply — version not resolved*."},"severity":{"type":"string"},"summary":{"type":"string"}}},"AiToolSettingsView":{"type":"object","description":"Which email domains this workspace considers its own.\n\nDomains only, never addresses. The list is a property of the organisation,\nand an address in it would make this a second place employee identity lives —\none with none of `artifacts.program_account`'s documentation saying so.","required":["corporate_domains"],"properties":{"corporate_domains":{"type":"array","items":{"type":"string"},"description":"Lower-cased bare domains: `northwind.com`, never `@northwind.com`.\n\nIn the order they were entered. Empty is valid and is the default: with\nnothing configured, a built-in list of consumer providers applies."}}},"AlertListResponse":{"type":"object","required":["alerts","total"],"properties":{"alerts":{"type":"array","items":{"$ref":"#/components/schemas/AlertView"}},"next_cursor":{"type":["string","null"],"description":"Pass back as `cursor` for the next page. `null` means this was the last."},"total":{"type":"integer","format":"int64","description":"Every alert the filter matched, across all pages, not only this one."}}},"AlertView":{"type":"object","description":"One alert, end to end.","required":["id","reference","outcome","source","service","raised_by","severity","decided_at","recorded_at"],"properties":{"connection_id":{"type":["string","null"],"description":"The connection whose sync ingested the interaction this alert was made\nabout; `null` on every alert a machine's interaction produced, and on\nevery alert whose interaction is gone."},"decided_at":{"type":"string","description":"The decider's clock — what the list is ordered and filtered by, because\nthat is what an operator means by *this week*."},"endpoint":{"type":["string","null"]},"engine_labels":{"type":["array","null"],"items":{"type":"string"}},"engine_run_id":{"type":["string","null"],"description":"The run to open, and `null` once retention has taken it.\n\n**Read, not derived from `engine_type`.** A run is swept at 30 days by\ndefault and an alert is kept for a year, so the link is dead for most of\nan alert's life; a page that offers it anyway sends the reader to a 404,\nand the evidence beside it (`engine_score`, `engine_labels`) is still\ntrue."},"engine_score":{"type":["number","null"],"format":"double"},"engine_type":{"type":["string","null"]},"engine_version":{"type":["string","null"]},"host":{"type":["string","null"]},"id":{"type":"string"},"interaction_id":{"type":["string","null"],"description":"The interaction this judged. `null` for a server-side decision whose\nobservation arrives later on a different request, and for a fail-open\nwhere there may be none at all — **not** a sign that anything is missing."},"justification":{"type":["string","null"],"description":"The person's own words on a `justified` alert; null on every other."},"machine_id":{"type":["string","null"]},"machine_name":{"type":["string","null"]},"method":{"type":["string","null"]},"mode":{"type":["string","null"],"description":"`monitor` or `enforce`, as the policy stood when it decided. A\n`monitor` alert stopped nothing. `null` only on some older alerts."},"outcome":{"type":"string","description":"`passed`, `alerted`, `blocked` or `undetermined`.\n\n**`undetermined` is not a flavour of `passed`.** It says nothing looked,\nwhere `passed` says something looked and was satisfied. A reader that\nrenders them the same has reproduced the placebo failure the outcome was\nadded to make visible."},"policy_id":{"type":["string","null"]},"policy_name":{"type":["string","null"],"description":"The policy's name as it stands now, for a sentence. `null` where the\npolicy has been deleted — the version is still named, so the row degrades\nto an id rather than to nothing."},"policy_version":{"type":["integer","null"],"format":"int32","description":"**The exact version that decided**, not the one that is current. An\nauthor may have rewritten the rule since; this is what makes the row\nevidence rather than a pointer at whatever the policy says today."},"raised_by":{"type":"string","description":"What raised it: `action` (the policy's Alert action) or `justification`\n(a justified override). Every alert has one."},"reason":{"type":["string","null"],"description":"Why, in the decider's own words. Never customer content."},"recorded_at":{"type":"string","description":"When the server recorded the alert, by the server's clock. Retention\nages alerts by this time, not by `decided_at`."},"reference":{"type":"string","description":"The support code a stopped person was given, where one was shown."},"service":{"type":"string"},"severity":{"type":"string","description":"The alert's severity: `info`, `low`, `medium`, `high` or `critical`.\nIt is the severity the policy's Alert action set, or the outcome's\ndefault where the policy named none."},"source":{"type":"string","description":"`inline`, `policy` or `engine`. Carried verbatim: a reader must render a\nvalue it does not recognise rather than folding the field into a boolean."},"undetermined_reason":{"type":["string","null"],"description":"Which engine returned no verdict, on an `undetermined`. Names an engine."}}},"AlsoView":{"type":"object","required":["verb"],"properties":{"notify":{"type":"boolean","description":"An Alert that also tells the person in the moment (*Notify*)."},"severity":{"type":["string","null"]},"verb":{"type":"string","description":"`alert` or `webhook`."}}},"ArtifactDetailResponse":{"allOf":[{"$ref":"#/components/schemas/ArtifactView"},{"type":"object","required":["facts","supply_chain","shape","declares","declares_total","declared_in","declared_in_total"],"properties":{"declared_in":{"type":"array","items":{"$ref":"#/components/schemas/ArtifactLinkView"},"description":"The parents that declare it: on its own machine first, then, for a\npackage or an MCP server, on every machine holding the same one."},"declared_in_total":{"type":"integer","format":"int64","description":"How many things declare it in all; larger than the length of\n`declared_in` when that list stopped at its cap."},"declares":{"type":"array","items":{"$ref":"#/components/schemas/ArtifactLinkView"},"description":"What this artifact declares, by name, at most 200."},"declares_total":{"type":"integer","format":"int64","description":"How many things it declares in all; larger than the length of\n`declares` when that list stopped at its cap."},"declares_untracked":{"type":["integer","null"],"format":"int64","description":"Dependencies a manifest parsed that are out of AI scope, so the band can\nsay \"and N other dependencies\". `null` when the agent did not say."},"facts":{"type":"array","items":{"$ref":"#/components/schemas/CatalogueFactView"},"description":"Every effective fact about the component this resolved to, ordered by\nfacet then attribute.\n\n**Empty is a real state and there are three of them**: the artifact\noffers no key, the catalogue has never heard of it, or it knows the\nidentity and has classified nothing. `catalogued.resolution` tells\nthem apart."},"launch":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/LaunchView","description":"How an MCP server is started or reached (`mcp.server-config` only),\nfrom the tool's stored settings read. Names only, never values."}]},"shape":{"type":"string","description":"How this kind of artifact relates to others: `declares`, `declared`,\n`instructions`, `model` or `other`."},"supply_chain":{"$ref":"#/components/schemas/SupplyChainView","description":"The AI supply chain check on this artifact."}}}],"description":"One artifact and everything the registry says about it.\n\n**The facts are here and not on the list row**, deliberately. A page of\nfifty rows would carry three hundred facts to render at most a badge, and\nthe row already has what it needs: severity travels on\n`worst_issue_severity`, because a fact that is an accusation *is* an issue."},"ArtifactGroupView":{"type":"object","description":"One fold of the matched set.","required":["parts","artifact_count","machine_count"],"properties":{"artifact_count":{"type":"integer","format":"int64"},"head":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ArtifactLinkView","description":"For the `declared_in` grouping: the artifact the group is keyed by, the\nparent or the orphan itself. `artifact_count` counts it as well, so a\nparent declares `artifact_count - 1` artifacts."}]},"key":{"type":["string","null"],"description":"The value grouped on — the first field's part. `null` is a real group:\nunowned, no machine, or nothing catalogued."},"machine_count":{"type":"integer","format":"int64","description":"Distinct machines. One component on five machines is the reach an\noperator is asking about."},"parts":{"type":"array","items":{"type":["string","null"]},"description":"One part per field in `?group=`, in the order given, each `null`\nwhere the artifact has no value for that field."},"worst_issue_severity":{"type":["string","null"]}}},"ArtifactLinkView":{"type":"object","description":"One end of a parent/child link. The check summary (`catalogued`,\n`advisory_severity`, `flags`) is that of the artifact this entry names,\nread from its stored check.","required":["id","type","name","location","flags"],"properties":{"advisory_severity":{"type":["string","null"]},"asked":{"type":["string","null"],"description":"What the parent asked for: the declared range, else the version."},"catalogued":{"type":["string","null"]},"declares_total":{"type":["integer","null"],"format":"int64","description":"On a Declared in group's `head` only: how many artifacts it declares."},"flags":{"type":"array","items":{"type":"string"}},"id":{"type":"string","format":"uuid"},"line":{"type":["integer","null"],"format":"int32","description":"The child's line in the parent that declares it; `null` when the agent\ndid not report one."},"location":{"type":"string"},"machine_id":{"type":["string","null"],"format":"uuid"},"machine_name":{"type":["string","null"]},"name":{"type":"string"},"type":{"type":"string"}}},"ArtifactListResponse":{"type":"object","required":["artifacts","total"],"properties":{"artifacts":{"type":"array","items":{"$ref":"#/components/schemas/ArtifactView"}},"groups":{"type":["array","null"],"items":{"$ref":"#/components/schemas/ArtifactGroupView"},"description":"Present only when `group` was asked for, and then `artifacts` is empty.\nA page of groups (`limit`, default 50), continued with `next_cursor`.\n\nOne response type for both shapes, because they are one question asked\nat two resolutions and a second endpoint would be a second place to add\na filter field. Worst first, then largest."},"next_cursor":{"type":["string","null"],"description":"Pass back as `cursor` for the next page. `null` means this was the last."},"total":{"type":"integer","format":"int64","description":"Everything the filter matched across every page, not just the\nartifacts on this page.\n\nWith `group`, the number of groups the match folds into, across every\npage — the count the grouped list is paged against."}}},"ArtifactView":{"type":"object","required":["id","issue_count","tags","source","local_id","category","type","content_class","name","location","size_bytes","preview_truncated","body_stored","state","first_seen_at","last_seen_at","state_changed_at"],"properties":{"body_stored":{"type":"boolean","description":"Whether the server holds the artifact's whole body, matched to the hash\nthis row carries.\n\nUse this, not `preview_truncated`, to tell whether the whole artifact was\nscanned: a long artifact can have a truncated preview and still a full\nscan."},"catalogued":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/CatalogueView","description":"What the registry recognised this as.\n\n**`None` is a third state and not a missing one.** It means the artifact\noffers no key at all — no package coordinate and no `sha256` content\nhash — which is the ordinary case for an AI tool, a runtime, or a\nsession log. Rendering that as *unidentified* would file the whole tools\ninventory under Shadow AI, which is the one number on this surface that\nhas to mean what it says."}]},"category":{"type":"string"},"content_class":{"type":"string"},"content_collected_at":{"type":["string","null"]},"content_hash":{"type":["string","null"]},"content_preview":{"type":["string","null"],"description":"The bounded, redacted excerpt, or `null`.\n\n`null` does not mean the artifact was empty. It means content was never\ncollected — because nothing reads it, or because this kind of artifact\ncan never carry any."},"declares_total":{"type":["integer","null"],"format":"int64","description":"How many artifacts this one declares, for the kinds that declare any\n(`shape = declares`: a manifest, an MCP config, a plugin, a lockfile).\n`null` for every other kind, and on the single-artifact read, which\nlists the declared artifacts themselves."},"ecosystem":{"type":["string","null"]},"first_seen_at":{"type":"string"},"hash_basis":{"type":["string","null"]},"id":{"type":"string"},"issue_count":{"type":"integer","format":"int64","description":"Unresolved issues about this artifact, and the worst of them.\n\n`0` with a `null` severity is a real answer: nothing has checked this\nartifact yet, which is not the same as it being clean."},"last_seen_at":{"type":"string"},"local_id":{"type":"string"},"location":{"type":"string"},"machine_id":{"type":["string","null"]},"matched_signature":{"type":["string","null"]},"mtime":{"type":["string","null"]},"name":{"type":"string"},"owner":{"type":["string","null"],"description":"Which tool this artifact belongs to, or `null`.\n\n`null` means unowned, not unknown: a `package.json` belongs to a project\nand a weight file to whatever loads it, not to an AI tool."},"package_digest":{"type":["string","null"]},"package_range":{"type":["string","null"],"description":"The declared range (`^4.0.0`) beside the resolved `package_version`;\n`null` when the version was pinned."},"package_version":{"type":["string","null"]},"person_id":{"type":["string","null"],"description":"The id of the person this signed-in tool belongs to, resolved from\n`program_account`.\n\n`null` where no tool sign-in points at this artifact — nothing is\nsigned in, the address could not be matched to a person, or it has not\nbeen resolved yet since the tool last reported it. It is an id, never a\nname."},"preview_total_chars":{"type":["integer","null"],"format":"int32"},"preview_truncated":{"type":"boolean"},"program_account":{"type":["string","null"],"description":"The full email address a tool is signed in as. This is personal data:\nit identifies a person."},"program_last_used_at":{"type":["string","null"]},"program_organization":{"type":["string","null"],"description":"The organisation the tool reports being signed in to. `null` where the\ntool states none; few tools report one."},"program_seat_tier":{"type":["string","null"],"description":"The seat tier the tool reports, exactly as reported and not normalised."},"program_version":{"type":["string","null"],"description":"The installed program's posture. All five are `null` on everything that\nis not an `ai_tool` artifact, and independently `null` on one that is:\nthe six tools differ in what they state about themselves, and a version\nnobody could read is absent rather than guessed."},"publisher":{"type":["string","null"]},"purl":{"type":["string","null"]},"scan_root":{"type":["string","null"]},"scanner":{"type":["string","null"]},"settings_flag":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SettingsFlagView","description":"The worst open setting issue of an installed AI tool. `null` on every\nartifact that is not an AI tool, and on one with no open setting issue."}]},"size_bytes":{"type":"integer","format":"int64"},"source":{"type":"string"},"state":{"type":"string"},"state_changed_at":{"type":"string"},"tags":{"type":"array","items":{"type":"string"},"description":"The free-text labels somebody applied, alphabetically. Usually empty."},"tool_lock":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SessionLockView","description":"The live tool-wide lock on an installed AI tool. `null` on every artifact\nthat is not an AI tool, and on one not locked."}]},"tool_settings":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ToolSettingsView","description":"The tool's security settings on its machine, as the agent last read them.\nFilled only by `GET /artifacts/{id}`; always `null` in a list. `null`\nthere too for a tool not read yet, or an artifact that is not a tool."}]},"type":{"type":"string"},"worst_issue_severity":{"type":["string","null"]}}},"AttachmentView":{"type":"object","description":"One file that rode an interaction, for the drawer's Attachments section.","required":["id","name","extension","size_bytes","password_protected","parse_status","truncated"],"properties":{"entry_count":{"type":["integer","null"],"format":"int32","description":"Archives: total entries found, shown beside \"partially inspected\"."},"extension":{"type":"string","description":"Lowercased; `\"\"` when the file had none."},"id":{"type":"string"},"name":{"type":"string"},"parent_id":{"type":["string","null"],"description":"The id of the archive row this member came out of — another entry in\nthe same list. `null` for a top-level attachment."},"parse_status":{"type":"string","description":"`parsed | partial | unsupported | failed | encrypted_skipped |\ndeclined_decrypt`."},"password_protected":{"type":"boolean"},"preview":{"type":["string","null"],"description":"Up to 1 KiB of extracted text. This is content: it is withheld, like\n`request_preview`, from a caller not allowed to read interaction\ncontent. The file's name and size are metadata and always returned."},"sha256":{"type":["string","null"]},"size_bytes":{"type":"integer","format":"int64"},"truncated":{"type":"boolean","description":"Something about this attachment was cut short: the agent hit its own\nparsing limit, or the server shortened the preview. Shown as\n*partially inspected*."}}},"BandView":{"type":"object","description":"One named level of a score, such as *High*.","required":["label","from"],"properties":{"from":{"type":"number","format":"double","description":"The lowest number this band covers, in the score's own units —\n`prompt-injection` scores 0–1, so its High is 0.7. A policy always\nstores the number, never the band."},"label":{"type":"string"}}},"BlastRadiusView":{"type":"object","description":"What arming this policy would have changed, over a window.","required":["days","matched","would_have_stopped","undetermined","undetermined_would_block","machines","services","version","paused"],"properties":{"current_version_age_hours":{"type":["integer","null"],"format":"int64","description":"How long the version being previewed has existed, in whole hours, or\n`null` if that is not knowable.\n\nThe counts are not filtered by version, so when this is shorter than\nthe preview window, some of the matches belong to an earlier version of\nthe policy."},"days":{"type":"integer","format":"int64","description":"The window actually used, in whole days, after clamping."},"first_at":{"type":["string","null"],"description":"The earliest decision in the window, or `null` if there were none."},"machines":{"type":"integer","format":"int64","description":"Distinct machines among the matches."},"matched":{"type":"integer","format":"int64","description":"Interactions this policy matched while watching."},"paused":{"type":"boolean","description":"Whether this policy's group is Off: it reads as Disabled and runs\nnowhere, so enabling it changes nothing until its group is On. The\ncounts are still what it did while it ran."},"services":{"type":"array","items":{"$ref":"#/components/schemas/ServiceHitsView"}},"undetermined":{"type":"integer","format":"int64","description":"Interactions the policy could not decide, because an engine returned no\nverdict. Under a policy that fails closed, each of these becomes a\nblock once the policy is Enabled."},"undetermined_would_block":{"type":"integer","format":"int64","description":"How many of those undetermined interactions would become blocks: equal\nto `undetermined` when this policy fails closed, and zero when it fails\nopen."},"version":{"type":"integer","format":"int32","description":"The version the counts are being read *for*.","minimum":0},"would_have_stopped":{"type":"integer","format":"int64","description":"How many of those it would have **stopped**.\n\nEqual to `matched` when the policy binds an inline enforcing action, and\n**zero** when it does not — which is the fact a promote button most needs\nto be able to say out loud. An alert-only policy in `enforce` alerts,\nexactly as it did in `monitor`; promoting it changes nothing about what\nanybody can do, and a preview that reported its match count as a blast\nradius would be arguing for a change that has none."}}},"BrowserState":{"type":"string","enum":["reporting","not_managed","not_installed"]},"BrowserSummary":{"type":"object","description":"The Machines list's *3 of 4*: `covered` is how many are `reporting`.","required":["covered","total"],"properties":{"covered":{"type":"integer","format":"int32","minimum":0},"total":{"type":"integer","format":"int32","minimum":0}}},"BrowserView":{"type":"object","description":"One browser on the machine page.","required":["id","version","state"],"properties":{"extension_seen_at":{"type":["string","null"],"description":"RFC 3339, or null if the extension has never spoken."},"extension_version":{"type":["string","null"],"description":"The extension build the agent last heard from. Null if never."},"id":{"type":"string","description":"`chrome` | `edge` | `brave` | `chromium` | `firefox`."},"refusal":{"type":["string","null"],"description":"Why the policy is not in place. Null unless `state` is `not_managed`."},"state":{"$ref":"#/components/schemas/BrowserState"},"version":{"type":"string","description":"`\"\"` when the agent could not read it."}}},"BypassSignalView":{"type":"object","required":["field","values"],"properties":{"field":{"type":"string"},"values":{"type":"array","items":{"type":"string"}}}},"CaptureStrategyView":{"type":"string","description":"One of the five capture strategies a machine can be enrolled with. Some\npairs cannot be combined on one machine; the API refuses those.","enum":["extension","tls_intercept","network_steer","tool_hooks","filesystem"]},"CaptureTacticView":{"type":"string","description":"How a machine captures AI traffic, summarised as one of five capture tactics.","enum":["none","metadata","mitm_ca","extension","redirect"]},"CatalogueFactView":{"type":"object","description":"One thing the registry says about the component this artifact resolved to.\n\n**The drawer's half of the split.** A fact that is an *accusation* is an\nissue and is worked through in the queue; every other fact describes what the\nthing is and belongs here, beside the artifact, where somebody asking \"what\nam I looking at\" will find it. `serialization_format = gguf` is a fact;\n`alignment_status = abliterated` is an accusation.","required":["facet","attribute","value","source","observed_at","stale"],"properties":{"attribute":{"type":"string"},"evidence_source":{"type":["string","null"],"description":"Who evidenced it — the feed's name, or `first_party` for a curation.\n**`None` for both workspace variants, and that is not missing data**: the\nevidence for a workspace's own decision is its overlay row and the reason\non it, which is a different record."},"facet":{"type":"string"},"finding":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/FindingRefView","description":"Set where this value is itself a problem with the artifact, the kind\nthat raises an issue; `null` for a neutral fact."}]},"observed_at":{"type":"string"},"overridden_evidence_source":{"type":["string","null"]},"overridden_value":{"type":["string","null"],"description":"The value one level down that this replaced, and who evidenced it.\n`None` exactly where nothing was replaced."},"source":{"type":"string","description":"Which level of the chain spoke: `global`, `curated`, `curated_over_feed`,\n`workspace_override` or `workspace_added`.\n\nAll five, because collapsing any pair removes a distinction the operator\nneeds: *we decided this* and *somebody upstream did* have different\nowners and different appeals."},"stale":{"type":"boolean","description":"Whether this fact's feed is older than its declared maximum age. Always\nfalse for anything resting on no feed — a curation has no clock to fall\nbehind, and neither does a workspace's own decision."},"value":{"type":"string","description":"A term, an identifier, or a JSON array for the three list-valued\nattributes."}}},"CatalogueView":{"type":"object","description":"What the registry recognised an artifact as.\n\nThis is the outcome of a lookup, distinct from the artifact's `category`,\nwhich says what the artifact is on the machine.","required":["resolution","stale"],"properties":{"category":{"type":["string","null"],"description":"One of the ten component categories. `None` for `unidentified`."},"display_name":{"type":["string","null"]},"identity":{"type":["string","null"],"description":"The registry's key. `None` for `unidentified`."},"resolution":{"type":"string","description":"`entry`, `not_catalogued`, `nothing_to_look_up` or `checking` (task\n6.24): what the supply-chain check stored, so the list, the grouping\nand the inspector read one value. `checking` is an artifact the check\nhas not reached yet, and is never shown as clean."},"stale":{"type":"boolean","description":"Whether any fact under this rests on a feed older than that feed's\ndeclared maximum age."}}},"CategoryVerbView":{"type":"object","description":"One verb a Host category offers beyond the subject's own list, and on which\ntriggers — for example, Fix on AI tool, while present.","required":["verb","events","applies_to"],"properties":{"applies_to":{"type":"array","items":{"type":"string"},"description":"The tools it acts on; every other tool still alerts and files issues."},"events":{"type":"array","items":{"type":"string"},"description":"The triggers it is offered on: `present` (the standing evaluation) or event words."},"verb":{"type":"string"}}},"CommandListResponse":{"type":"object","required":["commands"],"properties":{"commands":{"type":"array","items":{"$ref":"#/components/schemas/CommandView"},"description":"Newest first."}}},"CommandView":{"type":"object","description":"One command sent to a machine, and what came of it.\n\n`state` is where the command is; `ack_result` and `ack_reason` say what\nthe agent reported. `acked_at` null means **pending**: not yet picked up\nby the machine, or still awaiting an answer. Acknowledged with `ok` is\ndone; `failed` and `unsupported` carry the agent's own sentence in\n`ack_reason`.","required":["id","kind","payload","issued_at","state","expires_at","delivery_count"],"properties":{"ack_reason":{"type":["string","null"],"description":"The agent's own account of what happened, written for a person —\n\"round trip 23 ms\", \"no TUN driver is available on this machine\"."},"ack_result":{"type":["string","null"],"description":"`ok`, `failed` or `unsupported`, or null while pending."},"acked_at":{"type":["string","null"],"description":"RFC 3339, or null while the command is still pending delivery."},"delivered_at":{"type":["string","null"],"description":"RFC 3339, the latest delivery; null if never delivered."},"delivery_count":{"type":"integer","format":"int32","description":"How many heartbeats have carried it."},"expires_at":{"type":"string","description":"RFC 3339. When an unanswered command stops being delivered."},"id":{"type":"string"},"issued_at":{"type":"string","description":"RFC 3339."},"kind":{"type":"string"},"payload":{"description":"What was asked, verbatim — `{\"level\": \"debug\"}` on a `set_log_level`,\n`{}` on the rest. Operator-authored, never agent-authored."},"state":{"type":"string","description":"`pending`, `acked`, `expired` or `quarantined`.\n`expired`: passed `expires_at` without an answer. `quarantined`:\ndelivered `delivery_count` times with no ack, so the agent may be\ncrashing on it. Neither is ever delivered again."}}},"CommentListResponse":{"type":"object","required":["comments"],"properties":{"comments":{"type":"array","items":{"$ref":"#/components/schemas/CommentView"},"description":"**Oldest first, tombstones included.** A discussion is read in the order\nit happened, and a withdrawn comment keeps its row and its position —\nits absence would leave the replies under it reading as remarks about\nnothing."}}},"CommentView":{"type":"object","description":"One comment on an artifact or an issue.","required":["id","subject_kind","subject_id","author_id","author_display_name","created_at"],"properties":{"author_display_name":{"type":"string","description":"The author's display name."},"author_id":{"type":"string"},"body":{"type":["string","null"],"description":"`null` **exactly** when `withdrawn_at` is set, and the schema says the\nsame thing as a CHECK in both directions: a tombstone cannot carry text\nand a live comment cannot be blank."},"created_at":{"type":"string"},"id":{"type":"string"},"parent_id":{"type":["string","null"],"description":"`null` for a top-level comment; otherwise the comment this replies to.\nNever two levels deep."},"subject_id":{"type":"string"},"subject_kind":{"type":"string"},"withdrawn_at":{"type":["string","null"]}}},"CompileResponse":{"type":"object","required":["hash","warnings","halted"],"properties":{"halted":{"type":"boolean","description":"Whether this publish happened while enforcement is halted, and therefore\nenforces nothing whatever the policy list says."},"hash":{"type":"string"},"warnings":{"type":"array","items":{"$ref":"#/components/schemas/CompileWarningView"},"description":"Policies that compiled but **cannot fire in this workspace as it is\nconfigured** — almost always because of which backend an engine is set\nto. Empty is the normal case.\n\nA warning and not a refusal: such a policy is undetermined rather than\ninvalid, and refusing the compile would let switching a backend brick\npublishing for a whole workspace. Silence was the other option, and it\nis the worse one — an operator would leave a policy in `enforce`\nbelieving it covers something nothing is looking for."}}},"CompileWarningView":{"type":"object","description":"One policy that will not fire, and why.","required":["policy_id","policy_name","engine","reason","message"],"properties":{"engine":{"type":"string"},"label":{"type":["string","null"],"description":"The canonical label the condition binds, when the warning is about one."},"message":{"type":"string","description":"The same thing in a sentence, for an operator who is not going to look\nthe reason code up."},"policy_id":{"type":"string"},"policy_name":{"type":"string","description":"The policy's own name, so an operator recognises it in the list. The id\nis the handle they act on."},"reason":{"type":"string","description":"Stable and machine-readable: `label_not_emittable`, `no_backend`,\n`engine_has_no_runner`, or `engine_unknown`. `no_backend` is the one you\ncan fix, by choosing a backend for the engine; `engine_has_no_runner`\ncannot be fixed by any setting."}}},"ConfigSectionView":{"type":"object","description":"One configuration section of a machine and whether it is applied.","required":["section","state","desired_rev"],"properties":{"applied_rev":{"type":["string","null"]},"desired_rev":{"type":"string"},"reason":{"type":["string","null"],"description":"Not applied only: the agent's reason."},"section":{"type":"string"},"since":{"type":["string","null"],"description":"RFC 3339. Applied: when. Pending: since. Not applied: when it failed.\nUnknown: null."},"state":{"type":"string","description":"`applied` | `pending` | `not_applied` | `unknown`."}}},"ConnectionActionView":{"type":"object","required":["id","action","label","record_kind","external_id","trigger","outcome","at"],"properties":{"action":{"type":"string"},"at":{"type":"string"},"detail":{"type":["string","null"],"description":"One short word, never a vendor client's `Display`: one of the five\nfailure words on a failure, `not_applicable` on a refusal, and\n`accepted` / `already_done` — the vendor's own distinctions — on the two\nsuccesses that have one. `null` on a plain success."},"external_id":{"type":"string"},"id":{"type":"string"},"label":{"type":"string","description":"The descriptor's label — *Archive repository* — so a row reads as a\nsentence. The id is beside it because a link is built from the id and a\nsentence is written with the label."},"outcome":{"type":"string","description":"`done` | `failed` | `refused`."},"policy_id":{"type":["string","null"]},"policy_version":{"type":["integer","null"],"format":"int32"},"record_kind":{"type":"string"},"trigger":{"type":"string","description":"What started the action: `policy` (a policy ran it) or `operator` (a\nperson ran it by hand)."}}},"ConnectionOptionView":{"type":"object","description":"One connection the trigger step can offer.","required":["id","name","connector","connector_name","mark","modes","state"],"properties":{"connector":{"type":"string"},"connector_name":{"type":"string","description":"*GitHub*, so the `Select` reads *acme-org — GitHub* rather than\n*acme-org — github*."},"id":{"type":"string"},"mark":{"type":"string"},"modes":{"type":"array","items":{"type":"string"}},"name":{"type":"string","description":"The operator's own name for it — how two organisations are told apart."},"state":{"type":"string"}}},"ConnectionServiceView":{"type":"object","required":["host","interactions","blocked"],"properties":{"blocked":{"type":"integer","format":"int64","description":"Interactions with at least one `blocked` decision."},"host":{"type":"string","description":"The AI service host, e.g. `api.anthropic.com`."},"interactions":{"type":"integer","format":"int64"}}},"ConnectionToolView":{"type":"object","required":["name","interactions"],"properties":{"interactions":{"type":"integer","format":"int64"},"kind":{"type":["string","null"],"description":"The commonest declared client kind among its interactions."},"name":{"type":"string","description":"The client's own declared name, e.g. `Claude Code`; its `client_kind`\nword (`cli`, `ide`, …) when it declared none; `other` when neither."}}},"ConnectorActionCapabilityView":{"type":"object","description":"One concrete action, as this connection can (or cannot) perform it.","required":["connector","id","label","consequence","available"],"properties":{"available":{"type":"boolean"},"connector":{"type":"string","description":"The connector that declares this action."},"consequence":{"type":"string","description":"One sentence, shown in the confirmation and beside the option in the\naction step."},"id":{"type":"string"},"label":{"type":"string"},"unavailable_reason":{"type":["string","null"],"description":"`available: false` plus a reason is the payload, never an omission —\nthis module's own rule, and the reason is the probe's own sentence."},"verb":{"type":["string","null"],"description":"The general verb this action is grouped under, such as `quarantine`,\nor `null` where it stands alone."}}},"ConnectorCapabilityView":{"type":"object","description":"Everything the Connector trigger needs, and `null` on every other trigger.","required":["connections","record_kinds","actions"],"properties":{"actions":{"type":"array","items":{"$ref":"#/components/schemas/ConnectorActionCapabilityView"}},"connections":{"type":"array","items":{"$ref":"#/components/schemas/ConnectionOptionView"},"description":"The live connections this workspace has. Always present on a Connector\ndocument, because the trigger step's first control is this `Select`."},"record_kinds":{"type":"array","items":{"$ref":"#/components/schemas/RecordKindCapabilityView"},"description":"Empty without `connection=`: a record kind is a fact about one\nconnection's credential, and answering for \"any of them\" would offer a\ncatalogue no connection has."}}},"ConnectorInputView":{"type":"object","required":["id","label","wire","fetched"],"properties":{"fetched":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"max_bytes":{"type":["integer","null"],"format":"int64"},"wire":{"type":"string","description":"The value a filter's `input` carries, `connector:<id>`. Send it as it\nis."}}},"ContentRequestCountsView":{"type":"object","required":["queued","in_flight","stored","failed","outstanding"],"properties":{"failed":{"type":"integer","format":"int64","description":"Requests that used up every attempt without the file contents arriving.\nFinal: the server has stopped asking, so these are not counted as still\nin progress."},"in_flight":{"type":"integer","format":"int64","description":"The agent said it holds the request (`acknowledged`)."},"outstanding":{"type":"integer","format":"int64","description":"Requests that could still end with the file contents stored."},"queued":{"type":"integer","format":"int64","description":"Outstanding and not yet acknowledged: `requested`, plus `failed` short\nof the attempt cap — both are still waiting on a beat to move them."},"stored":{"type":"integer","format":"int64","description":"The body arrived (`stored`). Terminal."}}},"ContentRequestRowView":{"type":"object","required":["artifact_id","name","location","content_hash","state","attempts","requested_at"],"properties":{"acknowledged_at":{"type":["string","null"]},"artifact_id":{"type":"string"},"attempts":{"type":"integer","format":"int32"},"content_hash":{"type":"string"},"last_error_class":{"type":["string","null"]},"location":{"type":"string"},"name":{"type":"string"},"requested_at":{"type":"string","description":"RFC 3339."},"settled_at":{"type":["string","null"]},"state":{"type":"string","description":"`requested`, `acknowledged`, `stored`, `failed`, `superseded` or\n`refused`."}}},"ContentState":{"type":"string","description":"What happened to an interaction's text, for this reader.\n\nTaken in this order, first match wins:\n\n1. `withheld` — text exists and this caller may not read it. First, because\n   every later answer would describe text the caller cannot see.\n2. `dropped` — the workspace's interaction logging mode removed it.\n3. `pending` — text is here and its logging mode has not been applied yet:\n   the interaction's policies are still deciding, and the mode then keeps\n   or removes it.\n4. `captured` — text is here and stays.\n5. `not_captured` — there never was any: the machine's capture tactic\n   collects none, or the request carried none.","enum":["captured","not_captured","dropped","withheld","pending"]},"CoverageResponse":{"type":"object","required":["endpoints"],"properties":{"endpoints":{"type":"array","items":{"$ref":"#/components/schemas/UnmatchedEndpointView"},"description":"Newest activity first, one row per path, not grouped. Paths that\ndiffer only by a generated segment appear as separate rows."}}},"CreateGroupRequest":{"type":"object","description":"A new own group.","required":["subject","name"],"properties":{"description":{"type":"string"},"name":{"type":"string"},"policy_ids":{"type":"array","items":{"type":"string"},"description":"Members, in order: this workspace's own policies of `subject`, in no other\ngroup."},"subject":{"type":"string","description":"`prompt`, `file_artifact` or `hook`."}}},"CreatePolicyInput":{"type":"object","description":"A new policy: its body, and the state it starts in.\n\nStarting it Enabled (`enforce`) needs the same permission as enabling an\nexisting policy. To change the state of a stored policy, use\n`POST /policies/{id}/mode`.","required":["body"],"properties":{"body":{},"mode":{"type":["string","null"],"description":"One of `draft`, `monitor`, `enforce`. Absent is `draft`, as every create\nwas before this field existed."}}},"DecisionDetail":{"type":"object","required":["decision"],"properties":{"decision":{"$ref":"#/components/schemas/DecisionTrace"},"issue":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DecisionIssueRef","description":"The issue the policy's Issue action grouped this decision into, if any."}]}}},"DecisionIssueRef":{"type":"object","required":["id","title","status"],"properties":{"id":{"type":"string"},"status":{"type":"string","description":"`open | acknowledged | resolved | suppressed`."},"title":{"type":"string"}}},"DecisionKpis":{"type":"object","required":["window","decisions","blocked","redacted","justified","undetermined"],"properties":{"blocked":{"type":"integer","format":"int64"},"decisions":{"type":"integer","format":"int64","description":"Decisions and connector actions in the window."},"justified":{"type":"integer","format":"int64"},"p95_ms":{"type":["number","null"],"format":"double","description":"Weighted p95 of the engine runs that served a policy; workspace-wide."},"redacted":{"type":"integer","format":"int64","description":"Redactions that happened: enforcing matches on a policy version that\nlists Redact and no Block (which would have won)."},"undetermined":{"type":"integer","format":"int64"},"window":{"type":"string"}}},"DecisionOutcomeCount":{"type":"object","required":["outcome","count"],"properties":{"count":{"type":"integer","format":"int64"},"outcome":{"type":"string"}}},"DecisionPage":{"type":"object","required":["decisions","total"],"properties":{"decisions":{"type":"array","items":{"$ref":"#/components/schemas/DecisionTrace"}},"next":{"type":["string","null"]},"total":{"type":"integer","format":"int64","description":"Every decision the window and filters match, whatever page this is."}}},"DecisionTrace":{"type":"object","required":["id","at","provided","outcome","decided_by","runs","kind","actions","removed"],"properties":{"account":{"type":["string","null"]},"action_label":{"type":["string","null"],"description":"On an `action` row: the descriptor's label (`Archive repository`)."},"actions":{"type":"array","items":{"type":"string"},"description":"The verbs the deciding policy version lists, wire names, in its order.\n`[\"connector_action\"]` on an `action` row. Empty for a caller holding\nonly `alerts:read`."},"alert_raised_by":{"type":["string","null"],"description":"`action | justification` when this decision raised an alert, else null."},"ask_outcome":{"type":["string","null"],"description":"How an Ask ended (`confirmed`, `declined`, …)."},"at":{"type":"string"},"connection_id":{"type":["string","null"]},"connection_name":{"type":["string","null"]},"decided_by":{"type":"string","description":"`inline | policy | engine | connector` (`kind=action` rows): who decided."},"decider_name":{"type":["string","null"],"description":"The decider built into the agent, on an inline decision: `Self-protection`,\n`Upload inspection`, `Session lock`. Read from the decision, or from the agent's\nfixed reason on a row that names no policy and was recorded before it named one."},"evaluation_id":{"type":["string","null"],"description":"The evaluation the decision's runs share (0182)."},"explanation":{"type":["string","null"],"description":"What the agent's own fixed reason means, in a sentence or two. Null\nwhere the reason is a policy's own words."},"host":{"type":["string","null"]},"id":{"type":"string"},"interaction_id":{"type":["string","null"]},"justification":{"type":["string","null"],"description":"The person's own words on a `justified` decision. Null unless the caller\nholds `alerts:read`."},"kind":{"type":"string","description":"`decision` for a decision about an interaction; `action` for something\na rule or a person did through a connection."},"machine_group":{"type":["string","null"],"description":"The machine's group, when it has one."},"machine_id":{"type":["string","null"]},"machine_name":{"type":["string","null"]},"mode":{"type":["string","null"],"description":"`monitor | enforce`, as the policy stood when it decided."},"not_inspected":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/NotInspectedView","description":"Set when this interaction's content was not inspected because of its\nsize: the policy decided on the metadata alone, and this carries the\nsize the request had and the limit it met. Null on every other row."}]},"outcome":{"type":"string"},"policy_id":{"type":["string","null"]},"policy_name":{"type":["string","null"]},"policy_version":{"type":["integer","null"],"format":"int32"},"provided":{"type":"boolean"},"reason":{"type":["string","null"]},"recorded_at":{"type":["string","null"],"description":"When the row was written, the second clock beside `at`. Absent on a\nconnector action, which keeps one instant."},"reference":{"type":["string","null"],"description":"`SG-XXXX-XXXX-XXXX-C`. Null on a connector action, which nobody was handed."},"removed":{"type":"boolean","description":"Its machine or connection has been removed."},"runs":{"type":"array","items":{"$ref":"#/components/schemas/DecisionTraceRun"}},"target":{"type":["string","null"],"description":"On an `action` row: the record, `repository acme/api`."},"tool":{"type":["string","null"]},"total_ms":{"type":["number","null"],"format":"double","description":"From the first run starting to the last one ending; null with no runs."}}},"DecisionTraceRun":{"type":"object","required":["run_id","engine_id","outcome","matched"],"properties":{"engine_id":{"type":"string"},"matched":{"type":"boolean","description":"The run's verdict on this decision's policy was `matched` (a run can be\n`ok` and still not match)."},"offset_ms":{"type":["number","null"],"format":"double","description":"From the start of the decision's first run."},"outcome":{"type":"string","description":"`ok | error | timeout`."},"run_id":{"type":"string"},"score":{"type":["number","null"],"format":"double"},"selector":{"type":["string","null"]},"took_ms":{"type":["number","null"],"format":"double"}}},"DecisionView":{"type":"object","required":["id","reference","decided_by","outcome","decided_at","recorded_at","pending"],"properties":{"ask_outcome":{"type":["string","null"],"description":"How that Ask ended: `confirmed`, `declined`, `unanswered`,\n`no_companion`, `queue_full`, `asked_in_tool` or `paused`. Filled\nexactly where `ask_route` is."},"ask_route":{"type":["string","null"],"description":"Where an Ask was put when this decision asked: `native` (in the AI\ntool itself) or `companion` (the Oxelone companion app). Filled on\n`GET /interactions/{id}`; `null` on the list and on every decision that\nasked nothing."},"decided_at":{"type":"string"},"decided_by":{"type":"string","description":"`inline`, `policy` or `engine`. Shown verbatim: \"blocked on the laptop\nfrom the bundle\" and \"blocked by the server\" are different facts to\nsomebody chasing a false positive."},"decider_id":{"type":["string","null"],"description":"A policy version id, an engine run id, or a rule name. `null` only for an\ninline decision, whose decider is the agent the interaction already\nnames."},"decider_name":{"type":["string","null"],"description":"The same decider as `decider_id`, in words: a policy's name or an\nengine's display name.\n\n`null` for an inline decision, for a `decider_id` that names a rule,\nand for a decider that has since been deleted; fall back to\n`decider_id` then."},"explanation":{"type":["string","null"],"description":"What the agent's own fixed reason means, in a sentence or two. Null for a\npolicy's own words. Beside `reason`, never instead of it."},"id":{"type":"string"},"justification":{"type":["string","null"],"description":"The person's words on a `justified` outcome. An audit record, like\n`reason` — never the prompt — and served with the decision."},"outcome":{"type":"string","description":"`passed`, `alerted` or `blocked`. An interaction that alerted *and* was\nblocked has two of these, deliberately."},"pending":{"type":"boolean","description":"`true` while a verdict is still owed: the decision is `undetermined`\nand its policy has not finished evaluating the interaction yet. `false`\non an `undetermined` decision means evaluation finished and still\ncould not decide."},"reason":{"type":["string","null"]},"recorded_at":{"type":"string"},"reference":{"type":"string","description":"The reference shown to a person whose request was stopped, for them to\nquote when they ask about it.\n\nPresent on every decision, including a `passed` one, though it only\nmeans something where the decision enforced something. Upper case and\nhyphenated; treat it as opaque, since its length, grouping and\nalphabet may change."}}},"DecisionsBucket":{"type":"object","required":["decisions"],"properties":{"decisions":{"type":"integer","format":"int64"}}},"DecisionsSummary":{"type":"object","required":["window","bucket_starts","policies","undetermined_reasons"],"properties":{"bucket_starts":{"type":"array","items":{"type":"string"},"description":"Twelve RFC 3339 bucket starts, oldest first."},"policies":{"type":"array","items":{"$ref":"#/components/schemas/PolicyDecisionStat"},"description":"Every policy with a decision in the window. Passed decisions are not\nkept except where the late pass settled one."},"undetermined_reasons":{"type":"array","items":{"$ref":"#/components/schemas/UndeterminedReasonCount"}},"window":{"type":"string"}}},"DiagnosticsSummaryView":{"type":"object","required":["id","command_id","collected_at","received_at","agent_version","log_bytes_total","truncated","stored_bytes"],"properties":{"agent_version":{"type":"string"},"bundle_hash":{"type":["string","null"]},"collected_at":{"type":"string","description":"RFC 3339, from the endpoint's clock."},"command_id":{"type":"string"},"id":{"type":"string"},"last_error_kind":{"type":["string","null"],"description":"A short classification of the agent's last failure, or null. Served on\nthe *list* as well as the detail — unlike `log_tail` it is bounded, and\nit is the field that makes ten near-identical bundles scannable\n(\"which of these was the one that timed out\"). Omitting it would mean\nopening all ten to find out."},"log_bytes_total":{"type":"integer","format":"int64"},"received_at":{"type":"string","description":"RFC 3339, from ours."},"stored_bytes":{"type":"integer","format":"int32"},"truncated":{"type":"boolean"}}},"DiagnosticsView":{"type":"object","required":["id","command_id","collected_at","received_at","agent_version","log_bytes_total","truncated","stored_bytes","counters","log_tail"],"properties":{"agent_version":{"type":"string"},"bundle_hash":{"type":["string","null"]},"collected_at":{"type":"string"},"command_id":{"type":"string"},"counters":{"description":"Free-form counters, exactly as the agent sent them."},"id":{"type":"string"},"last_error_kind":{"type":["string","null"]},"log_bytes_total":{"type":"integer","format":"int64"},"log_tail":{"type":"string","description":"The end of the agent's log. Only a single bundle carries it; the list\ndoes not."},"received_at":{"type":"string"},"stored_bytes":{"type":"integer","format":"int32"},"truncated":{"type":"boolean"}}},"DirectoryRefView":{"type":"object","required":["location","reach"],"properties":{"location":{"type":"string"},"reach":{"type":"string","description":"`home` | `drive_root` | `inside_home` | `outside_home`."}}},"DismissalView":{"type":"object","required":["id","reason","at"],"properties":{"at":{"type":"string","description":"RFC 3339."},"by":{"type":["string","null"]},"id":{"type":"string","format":"uuid"},"reason":{"type":"string"},"version":{"type":["string","null"],"description":"`null` for every version."}}},"DuplicateRequest":{"type":"object","properties":{"name":{"type":["string","null"],"description":"The copy's name; \"Copy of <vendor name>\" when absent."}}},"EnforcementStateView":{"type":"object","description":"The workspace's enforcement state and how far what it published has\nreached its machines.","required":["machines","on_current","never_reported","stale","propagation_seconds"],"properties":{"bundle_hash":{"type":["string","null"],"description":"The hash of what this workspace has published, or `null` if nothing has\nbeen. While it is `null` a machine has no site catalog, captures nothing,\nand reports `\"outcome\": \"no catalog\"`."},"halt":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HaltView","description":"The current halt, or `null` when enforcement is not halted."}]},"machines":{"type":"integer","format":"int64"},"never_reported":{"type":"integer","format":"int64"},"on_current":{"type":"integer","format":"int64"},"propagation_seconds":{"type":"integer","format":"int32","description":"How long a machine may take to notice a change, in seconds: the\ninterval at which this workspace's machines check in. A halt or a\npublish is not instant; alerts can keep arriving until then.","minimum":0},"stale":{"type":"integer","format":"int64"}}},"EngineAvailabilityView":{"type":"object","description":"Whether this engine will answer in this workspace, and the first thing to\nfix when it will not.","required":["state"],"properties":{"reason":{"type":["string","null"],"description":"`switched_off`, `weights_missing`, `backend_not_runnable`,\n`no_backends`, `no_default_model`, `model_connection_blocked` or\n`plan_limit`. `null` when the engine is available."},"state":{"type":"string","description":"`available` or `unavailable`."},"step":{"type":["string","null"],"description":"The readiness step that is open: `switched_on` or `model`. `null` when\nthe engine is available."}}},"EngineConditionView":{"type":"object","description":"What one engine can actually be asked about, as the engine declares it.\n\nOffer a score condition only when `score` is present; an engine without\none emits labels only.","required":["engine","display_name","labels","judges","sub_engines","fields","locus","availability"],"properties":{"applies_to":{"type":"array","items":{"type":"string"},"description":"The Host categories this engine can answer about. Empty means every\ncategory — see the same field on a predicate."},"availability":{"$ref":"#/components/schemas/EngineAvailabilityView","description":"Whether this engine will answer in this workspace, the same answer\n`GET /engines` gives. **An unavailable engine is still listed**: a row\nmay be written over it, and the editor warns beside the row."},"display_name":{"type":"string","description":"The engine's display name, as the engine list shows it."},"engine":{"type":"string","description":"The engine's id, as a policy's engine filter names it."},"fields":{"type":"array","items":{"$ref":"#/components/schemas/EngineFieldView"},"description":"The fields of the engine's own output a filter may read. Empty until\nthe engine publishes them."},"judges":{"type":"array","items":{"$ref":"#/components/schemas/JudgeConditionView"},"description":"Only for `llm-judge`, and empty for every other engine."},"labels":{"type":"array","items":{"$ref":"#/components/schemas/LabelView"},"description":"The label vocabulary, **narrowed to the backend this workspace\nselected**. An unemittable label is listed and flagged rather than\ndropped: a policy written against a build that could emit it must still\nrender, and the editor must still not offer it as a new condition."},"locus":{"type":"string","description":"`agent` | `server` — where this engine runs, and therefore where a\nfilter conditioned on it is answered: on the machine, or by Oxelone."},"score":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ScoreView","description":"`None` for every engine whose conditions are labels only, and the\nbuilder must then not offer a score row **at all**."}]},"sub_engines":{"type":"array","items":{"$ref":"#/components/schemas/SubEngineView"},"description":"Always empty; the AI supply chain checks are the `supply_chain_*`\nfields. Kept so older clients still parse the document."}}},"EngineFieldView":{"type":"object","description":"One field of an engine's output a policy filter may read.\n\nOnly fields that can be enabled are listed. An engine that has not\npublished its fields yet has an empty list, not a guessed one.","required":["path","label","shape","operators","values"],"properties":{"label":{"type":"string","description":"The field's display name."},"operators":{"type":"array","items":{"type":"string"},"description":"The comparisons the shape offers, in display order."},"path":{"type":"string","description":"The dotted path the row stores: `count`, `by_type.api_key`."},"shape":{"type":"string","description":"The value's shape: `number` | `boolean` | `enum` | `text` | …"},"values":{"type":"array","items":{"type":"string"},"description":"For an `enum` shape, its members; empty otherwise."}}},"EnumOptionView":{"type":"object","description":"One member of a list of values a filter may take, such as a service or a\nmachine group.","required":["id","display","usable"],"properties":{"category":{"type":["string","null"],"description":"The Host category this member belongs to, or `null` for every list but\n`artifact_type`. The `artifact_type` list covers every category; use\nthis to narrow it to the category a policy picked."},"display":{"type":"string"},"group":{"type":["string","null"],"description":"The heading a picker lists it under: an AI tool's kind (CLI, IDE,\nDesktop, Extension, Local, or Other). Absent on every other list."},"id":{"type":"string","description":"The value a `Predicate` stores. Never the display name — a machine is\nbound by id so a rename does not detach the policy."},"observed":{"type":["boolean","null"],"description":"Whether this workspace has been seen using it. Set on the service and\nAI tool lists only; absent elsewhere, and absent for a caller without\n`machines:read`, because it is usage data."},"usable":{"type":"boolean","description":"Whether a condition on this member could ever fire. An unusable member\nis still listed, so existing policies that name it stay readable, but\nit should not be offered for a new condition."}}},"EnvironmentView":{"type":"object","description":"The network a machine last said it is on.","required":["kind","flags","observed_at"],"properties":{"flags":{"type":"array","items":{"type":"string"},"description":"`tls_inspected` | `root_missing` | `captive`."},"kind":{"type":"string","description":"`direct` | `upstream_proxy` | `vpn` | `sase_proxy` | `sase_tunnel`."},"mode":{"type":["string","null"],"description":"`vpn` only: `full` | `split`."},"observed_at":{"type":"string","description":"RFC 3339, this server's clock: when it first saw this network. The\nagent's own `since` is not served."},"owner":{"type":["string","null"],"description":"`vpn` only: the client that owns the tunnel, as the agent named it."},"proxy":{"type":["string","null"],"description":"`upstream_proxy` only: `fixed` | `pac` | `wpad`."},"vendor":{"type":["string","null"],"description":"`sase_proxy` and `sase_tunnel` only."}}},"EvaluatedByView":{"type":"object","description":"One policy that evaluated an interaction.","required":["id"],"properties":{"id":{"type":"string"},"name":{"type":["string","null"],"description":"The policy's name; `null` when it has since been deleted — it still\nevaluated this, and the id is the honest answer."}}},"EvidenceItemView":{"type":"object","description":"What matched. `kind` says which of the optional fields can be present.","required":["kind","args"],"properties":{"args":{"type":"array","items":{"type":"string"},"description":"A server's arguments, key-shaped values already `[redacted]` by the agent."},"key_kind":{"type":["string","null"],"description":"A stored key's kind, as the secrets engine names it (*GitHub personal access token*)."},"kind":{"type":"string","description":"`rule`, `server`, `plugin`, `key`, `directory` or `value`."},"launcher":{"type":["string","null"],"description":"A local server's launcher (`npx`) or a remote server's host."},"name":{"type":["string","null"],"description":"The rule's text, the server's name, the plugin's `name@marketplace`, the key's name, the\ndirectory, or the value as the vendor writes it. `null` for a key the reader could not\nname."},"package":{"type":["string","null"]},"pinned":{"type":["boolean","null"],"description":"A server's or a plugin's pin: `false` is not pinned, `null` nothing to say."},"reach":{"type":["string","null"],"description":"A directory's reach: `home`, `drive_root`, `inside_home`, `outside_home`."},"rev":{"type":["string","null"],"description":"A pinned plugin's commit prefix or tag."},"risk":{"type":["string","null"],"description":"A rule's risk word: `any_shell`, `any_fetch`, …"},"source":{"type":["string","null"],"description":"A plugin's source kind: `github`, `git`, `url`, `file`, `directory`."},"source_url":{"type":["string","null"]},"transport":{"type":["string","null"],"description":"A server's transport: `stdio`, `http`, `sse`."},"url":{"type":["string","null"]},"version":{"type":["string","null"]}}},"EvidenceView":{"type":"object","description":"One matched item and where it was found. Every string is one the agent\nalready sent from the tool's settings: a stored key appears as its name\nand kind, never its value.","required":["location","scope","raw_key","item"],"properties":{"item":{"$ref":"#/components/schemas/EvidenceItemView"},"location":{"type":"string","description":"Where the item was read from — a file, a registry key or a tool's own\nsettings store — with the home folder shown as `~`."},"project":{"type":["string","null"],"description":"For a project file: which project, `~`-collapsed."},"raw_key":{"type":"string","description":"The vendor's own key: `permissions.allow`, `mcpServers`, `env`."},"scope":{"type":"string","description":"`managed`, `user`, `project` or `default`."}}},"FacetCountView":{"type":"object","required":["value","count"],"properties":{"count":{"type":"integer","format":"int64"},"value":{"type":"string"}}},"FeedAnswerView":{"type":"object","description":"What one feed answered.","required":["feed","answer"],"properties":{"answer":{"type":"string","description":"`found`, `not_found` or `error`."},"answered_at":{"type":["string","null"],"description":"RFC 3339."},"detail":{"type":["string","null"]},"expires_at":{"type":["string","null"],"description":"RFC 3339."},"feed":{"type":"string"},"link":{"type":["string","null"]},"matched":{"type":["string","null"]}}},"FieldControl":{"type":"object","description":"One declared field: its kind, the operators it admits, and its range.","required":["field","kind","description","operators","members"],"properties":{"description":{"type":"string"},"field":{"type":"string"},"kind":{"type":"string","description":"`boolean`, `int`, `float` or `enum`."},"max":{"type":["number","null"],"format":"double"},"members":{"type":"array","items":{"type":"string"},"description":"For an enum: its members."},"min":{"type":["number","null"],"format":"double","description":"For a number: the ends of the range. `null` only on a whole number saved\nbefore ranges were required, which has no declared range."},"operators":{"type":"array","items":{"type":"string"},"description":"The operators this field admits, in the order to offer them."}}},"FileEventListResponse":{"type":"object","required":["events","total"],"properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/FileEventView"}},"next_cursor":{"type":["string","null"],"description":"Pass back as `cursor` for the next page. `null` means this was the last."},"total":{"type":"integer","format":"int64","description":"Everything the filter matched, not just this page."}}},"FileEventView":{"type":"object","required":["id","artifact_id","artifact_name","artifact_category","kind","at"],"properties":{"artifact_category":{"type":"string"},"artifact_id":{"type":"string"},"artifact_name":{"type":"string"},"at":{"type":"string"},"current_hash":{"type":["string","null"]},"detail":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SettingsChangeView","description":"On `settings_changed` only: what changed, in words and counts. `null` on\nevery other kind."}]},"id":{"type":"string"},"kind":{"type":"string"},"machine_id":{"type":["string","null"]},"previous_hash":{"type":["string","null"]},"scan_run_id":{"type":["string","null"],"description":"The scan that produced this event, when one is recorded. `null` for\nevents recorded before scans were tracked, and on events the server wrote\nitself because a scanned location stopped being reported: no scan\nproduced those."}}},"FindingRefView":{"type":"object","description":"The accusation a fact carries, named well enough for the drawer to point at\nits issue without restating it.","required":["rule","display","severity"],"properties":{"display":{"type":"string"},"rule":{"type":"string","description":"The engine's label, e.g. `supply_chain.npm_package.known_malicious` —\nthe same string the issue's `rule` holds, so the drawer can link to it."},"severity":{"type":"string"}}},"FirstPromptView":{"type":"object","required":["interaction","kept"],"properties":{"interaction":{"type":"string"},"kept":{"type":"string","description":"`kept` or `not_kept`."},"text":{"type":["string","null"],"description":"What the Interactions list shows for that interaction: `null` when the logging mode\nremoved it."}}},"FixKindView":{"type":"object","description":"One kind of Fix a policy may apply.","required":["kind","label","needs","applies_to"],"properties":{"applies_to":{"type":"array","items":{"type":"string"}},"kind":{"type":"string"},"label":{"type":"string"},"needs":{"type":"string","description":"What the row needs from the author: `filter` (it acts on what the filter matched),\n`list` (rules or sources typed in), `mode` (a start mode picked) or `none`."}}},"FlagEvidenceView":{"type":"object","required":["feed"],"properties":{"feed":{"type":"string"},"observed_at":{"type":["string","null"],"description":"RFC 3339."},"record":{"type":["string","null"]}}},"FlagView":{"type":"object","required":["key","label","evidence"],"properties":{"dismissed":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DismissalView"}]},"evidence":{"type":"array","items":{"$ref":"#/components/schemas/FlagEvidenceView"}},"key":{"type":"string"},"label":{"type":"string"}}},"GovernedByView":{"type":"object","required":["policy","name","mode","holds"],"properties":{"holds":{"type":"boolean","description":"The agent's last beat reported it holding for this tool."},"mode":{"type":"string","description":"`enforce` or `monitor`."},"name":{"type":"string"},"policy":{"type":"string"}}},"GrantView":{"type":"object","required":["grant_id","capabilities","created_at","expires_at","state","standing"],"properties":{"capabilities":{"type":"array","items":{"type":"string"}},"created_at":{"type":"string"},"expires_at":{"type":"string"},"first_used_at":{"type":["string","null"],"description":"`None` for a grant nobody ever pasted in — a fact worth showing, not a\ngap to hide."},"grant_id":{"type":"string"},"revoked_at":{"type":["string","null"]},"standing":{"type":"boolean","description":"The grant stands until revoked; `expires_at` is then a century out."},"state":{"type":"string","description":"`live`, `revoked` or `expired`."}}},"GroupDeleteView":{"type":"object","description":"A delete's answer: the publish it caused, or `null`.","properties":{"publish":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/CompileResponse"}]}}},"GroupView":{"type":"object","description":"One group on a workspace's wire. Provided and own alike; a provided one says\n`provided_by` and `vendor_version`.","required":["id","subject_kind","name","description","enabled","removed","member_ids"],"properties":{"description":{"type":"string"},"enabled":{"type":"boolean","description":"On (`true`) or Off. Off pauses every member."},"id":{"type":"string"},"member_ids":{"type":"array","items":{"type":"string"},"description":"The members, in member order."},"name":{"type":"string"},"provided_by":{"type":["string","null"],"description":"`oxelone` for a provided group; absent for the workspace's own."},"removed":{"type":"boolean","description":"A provided group this workspace removed (listed with the removed policies)."},"subject_kind":{"type":"string","description":"`prompt` (Network), `file_artifact` (Host) or `hook` (Hook)."},"vendor_version":{"type":["integer","null"],"format":"int32","description":"A provided group's content version: it moves when Oxelone changes\nthe name, the description or the members. Absent for an own group."}}},"GroupWriteView":{"type":"object","description":"A group write's answer: the group as stored, and the publish it caused —\n`null` when nothing that runs changed.","required":["group"],"properties":{"group":{"$ref":"#/components/schemas/GroupView"},"publish":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/CompileResponse"}]}}},"HaltRequest":{"type":"object","required":["reason"],"properties":{"reason":{"type":"string","description":"Why enforcement is being stopped. Must not be blank."}}},"HaltView":{"type":"object","required":["halted_at","reason"],"properties":{"halted_at":{"type":"string"},"reason":{"type":"string","description":"The reason given when enforcement was halted; always present."}}},"HealthReasonView":{"type":"object","description":"Why a machine is Degraded. Only the fields for `kind` are set.","required":["kind","sections","under_grant"],"properties":{"at":{"type":["string","null"],"description":"RFC 3339. `crashed`: when. `pac_unwitnessed`: since when the PAC has been applied with\nnothing fetching it. `tool_hooks_failed`: the first of the failing beats."},"kind":{"type":"string","description":"`steering_failed` | `root_removed` | `config_not_applied` | `crashed` | `worker_stopped` |\n`interception_off` | `pac_unwitnessed` | `tool_hooks_failed` | `ask_unavailable` |\n`clock_skew`, most severe first."},"reason":{"type":["string","null"],"description":"`steering_failed` only: the agent's sentence."},"sections":{"type":"array","items":{"type":"string"},"description":"`config_not_applied` only: every section not applied."},"sessions":{"type":["integer","null"],"format":"int32","description":"`ask_unavailable` only: how many signed-in people have no companion.\nIts `at` is since when.","minimum":0},"surface":{"type":["string","null"],"description":"`steering_failed` only: the surface that failed, when the agent named one."},"tamper_kind":{"type":["string","null"],"description":"`tampered` only: the tamper event's own kind. Its `at` is when, and\n`tool` the tool it touched, if any."},"tool":{"type":["string","null"],"description":"`tool_hooks_failed` only: the tool's registry slug."},"under_grant":{"type":"boolean","description":"`interception_off` only: turned off under an elevation grant."},"unit":{"type":["string","null"],"description":"`interception_off` only: `steering` | `tool_hooks`."},"worker":{"type":["string","null"],"description":"`worker_stopped` only."}}},"HistoryItemView":{"type":"object","description":"One thing that happened to this person.","required":["kind","at","id","summary"],"properties":{"at":{"type":"string"},"id":{"type":"string"},"kind":{"type":"string","description":"`action`, `event`, `interaction` or `issue`."},"link":{"type":["string","null"],"description":"Where the row opens, workspace-relative. `null` where nothing renders it."},"summary":{"type":"string","description":"Closed words and the source's own bounded label — never a prompt, a\nresponse or a body."}}},"HistoryView":{"type":"object","required":["items"],"properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/HistoryItemView"}},"next_cursor":{"type":["string","null"]}}},"HookActionView":{"type":"object","description":"One tool and action: the domain's fields, verbatim.","required":["events","tool_names","block","rewrite","native_ask","native_ask_enabled","ask_survives_bypass","companion_ask","sources"],"properties":{"ask_survives_bypass":{"type":"string","description":"Whether the tool's own ask still appears when it skips permissions: `yes`, `no`,\n`unknown`."},"block":{"type":"string","description":"Whether a deny holds: `yes`, `no` or `unverified`."},"companion_ask":{"type":"string","description":"Whether the companion can ask inside the tool's hook time limit: `yes`, `unverified`,\n`no`."},"events":{"type":"array","items":{"type":"string"},"description":"The tool's own hook events this action arrives on."},"native_ask":{"type":"string","description":"What the research found about the tool's own ask: `none`, `documented`, `undocumented`,\n`contested` or `unverified`."},"native_ask_enabled":{"type":"boolean","description":"Whether an Ask is put in the tool's own prompt today — true only after a live check\n(Claude Code and Gemini CLI start true)."},"rewrite":{"type":"boolean","description":"Whether the hook can rewrite the action's input."},"sources":{"type":"array","items":{"type":"string"},"description":"The research's sources."},"tool_names":{"type":"array","items":{"type":"string"},"description":"The vendor's tool names that classify as this action, where they are known."}}},"HookCapabilitiesView":{"type":"object","description":"The whole matrix.","required":["version","kinds","tools","if_no_companion"],"properties":{"if_no_companion":{"type":"string","description":"What an Ask at a hook does when no companion is running, as one sentence."},"kinds":{"type":"array","items":{"$ref":"#/components/schemas/HookKindWordView"},"description":"The eight action kinds with their words, in picker order."},"tools":{"type":"array","items":{"$ref":"#/components/schemas/HookToolView"},"description":"One per tool whose vendor documents blocking hooks, in the registry's order."},"version":{"type":"integer","format":"int32","description":"The capability document's version (`hook_capabilities.json`'s `version`).","minimum":0}}},"HookFallbackView":{"type":"string","description":"What a hook does when the agent cannot answer. One setting for every tool with hooks on.","enum":["allow","block"]},"HookKindView":{"type":"object","description":"One action kind a Hook policy may watch.","required":["id","label","fields","decisions"],"properties":{"decisions":{"type":"array","items":{"type":"string"},"description":"What a policy on this kind may decide: `allow`, `ask`, `block`, `lock` — or `allow`\nand `lock` on Session start, which no tool lets a hook stop (a lock refuses what follows)."},"fields":{"type":"array","items":{"type":"string"},"description":"The filters this kind offers, by predicate `kind`, in picker order."},"id":{"type":"string","description":"The wire word (`shell`, `file_write`, `tool_use`, …)."},"label":{"type":"string","description":"The display name: *Shell command*, *Tool call*."},"stop_refusal":{"type":["string","null"],"description":"Why Ask and Block are refused on this kind, or absent when they are not."}}},"HookKindWordView":{"type":"object","required":["id","label"],"properties":{"id":{"type":"string"},"label":{"type":"string","description":"The display name, e.g. *Shell command*, *Tool call*."}}},"HookToolView":{"type":"object","description":"One tool's row.","required":["slug","name","on_timeout","actions"],"properties":{"actions":{"type":"object","description":"Per action kind; a kind absent here has no hook on this tool.","additionalProperties":{"$ref":"#/components/schemas/HookActionView"},"propertyNames":{"type":"string"}},"bypass_signal":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/BypassSignalView","description":"Where the tool's payload says it is skipping permissions, or `null` where it says nowhere."}]},"name":{"type":"string","description":"The registry's display name (*Claude Code*, *Devin Desktop*)."},"on_timeout":{"type":"string","description":"What the tool does when its hook times out: `open` or `closed`."},"slug":{"type":"string","description":"The registry slug (`claude_code`)."},"timeout_secs":{"type":["integer","null"],"format":"int32","description":"The hook timeout we write into the tool's config, or `null` where it has no field\n(Windsurf: its own limit is unmeasured).","minimum":0}}},"HookTriggerView":{"type":"object","description":"The Hook trigger: one action kind per policy. Ask with\n`subject=hook&action=<kind>` for the filters that kind offers.","required":["kinds"],"properties":{"action":{"type":["string","null"],"description":"The action this document's `predicates` and `actions` are for — the\nquery's `action` — or `null` when none was asked, in which case\n`predicates` is every Hook filter and each kind's `fields` narrows it."},"kinds":{"type":"array","items":{"$ref":"#/components/schemas/HookKindView"},"description":"The eight kinds, in picker order."}}},"HostCategoryView":{"type":"object","description":"One Host category, as the sub-category picker lists it.","required":["id","label","events"],"properties":{"content_refusal":{"type":["string","null"],"description":"Why a filter over this category's content is refused, or absent when it\nis not refused — the domain own sentence, shown verbatim.\n\n**This is what keeps the narrowing from being unexplained.** Switching\na policy to *Model weights* takes the content filters out of the\npicker, and a picker that quietly gets shorter reads as a bug. The\neditor prints this beside the count it dropped."},"events":{"type":"array","items":{"type":"string"},"description":"The artifact events a Host policy over this category may be triggered\nby, in the File Events page's own order.\n\n**Not the same list for every category** — `HostCategory::\noffered_events` withholds `content_changed` from a category nothing\nhashes, and an AI Tool is an installation rather than a file. A picker\nthat offered it anyway would let an author arm a trigger that can never\nfire, which is the placebo this whole document exists to prevent."},"id":{"type":"string"},"label":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/CategoryVerbView"},"description":"Verbs this category alone offers, and on which triggers — today, Fix on\nAI tool, while present. Absent on every other category."}}},"InputView":{"type":"object","description":"One thing an engine can be fed, and where it may be fed.","required":["id","label","text_field","interaction_kinds","host_categories","engines"],"properties":{"engines":{"type":"array","items":{"type":"string"},"description":"The engines that will answer a filter written under this input. An\nengine that reads its subject by reference (rather than its text) is\nlisted only under `file_name` on Host and `request` on Network."},"host_categories":{"type":"array","items":{"type":"string"},"description":"The Host categories that allow it, as category ids. Empty means every\none — a file's name and location are known whatever the file is.\n`file_contents` names the five categories that carry text; the three\nopaque ones and AI Dependency (read as entries rather than text) are\nabsent. A Host policy that has picked no category may read contents.\nEmpty on a Network document; always present."},"id":{"type":"string","description":"The value a row's `input` carries: `prompt` | `attachment` | `request`\n| `file_contents` | `file_name`."},"interaction_kinds":{"type":"array","items":{"type":"string"},"description":"The sub-category choices under which this input is offered, where `all`\nmeans a policy that has not picked one. Empty means every choice, which\nis what the prompt and the whole request answer; only the attachment\nnarrows, to `[\"all\", \"attachment\"]`. Empty on a Host document; always\npresent."},"label":{"type":"string","description":"The display name: *The prompt*, *The file's contents*."},"text_field":{"type":"string","description":"The field a plain text filter over this input uses: `contains` and\n`matches pattern` are filters over `prompt_text`, `attachment_text`,\n`body`, `artifact_text` or `artifact_path`, not engine filters."}}},"InteractionKindView":{"type":"object","description":"One interaction kind, as the sub-category picker lists it.","required":["id","label"],"properties":{"id":{"type":"string"},"label":{"type":"string"},"redact_refusal":{"type":["string","null"],"description":"Why a Redact response is refused under this kind, or absent when it is\nnot. No kind carries one today: a text attachment is rewritten, and a\nbinary one carrying a named type is withheld."}}},"InteractionListResponse":{"type":"object","required":["interactions","total"],"properties":{"interactions":{"type":"array","items":{"$ref":"#/components/schemas/InteractionView"}},"next_cursor":{"type":["string","null"],"description":"Pass back as `cursor` for the next page. `null` means this was the last."},"total":{"type":"integer","format":"int64","description":"Every interaction the filter matched, across all pages, not only this\none."}}},"InteractionSessionGroupView":{"type":"object","description":"One session in the interactions list grouped by session: its header, and\nhow much of it the filter matched.","required":["count","matched","blocked","first_at","last_at"],"properties":{"blocked":{"type":"integer","format":"int64","description":"Of `count`, the ones a decision blocked."},"client_name":{"type":["string","null"],"description":"The tool's declared name, from the session's most recent row that\ndeclared one. `null` when none did, and on the group with no session."},"count":{"type":"integer","format":"int64","description":"Every interaction in the session, whatever the filter says. On the\ngroup with no session, the ones that matched."},"first_at":{"type":"string","description":"`observed_at` of the session's first and last interaction."},"last_at":{"type":"string"},"machine_id":{"type":["string","null"],"description":"The machine of the most recent row that names one."},"matched":{"type":"integer","format":"int64","description":"Of those, the ones the filter and the search matched — what opening\nthe session lists. Equal to `count` when nothing narrows the list."},"os_user":{"type":["string","null"],"description":"The OS account, from the most recent row that carried one."},"session_id":{"type":["string","null"],"description":"`null` is the group of matching interactions that carry no session id."}}},"InteractionSessionListResponse":{"type":"object","required":["sessions"],"properties":{"sessions":{"type":"array","items":{"$ref":"#/components/schemas/InteractionSessionView"}}}},"InteractionSessionPageResponse":{"type":"object","required":["sessions","total"],"properties":{"next_cursor":{"type":["string","null"],"description":"Pass back as `cursor` for the next page. `null` means this was the last."},"sessions":{"type":"array","items":{"$ref":"#/components/schemas/InteractionSessionGroupView"}},"total":{"type":"integer","format":"int64","description":"Sessions with at least one matching interaction; the group with no\nsession counts as one."}}},"InteractionSessionView":{"type":"object","description":"One session's summary: its tool, account, machine and counts.","required":["session_id","count","blocked","first_at","last_at"],"properties":{"blocked":{"type":"integer","format":"int64","description":"Of those, the ones a decision blocked."},"client_name":{"type":["string","null"],"description":"The tool's declared name, from the session's most recent row that\ndeclared one. `null` when none did."},"count":{"type":"integer","format":"int64","description":"Interactions in the session."},"first_at":{"type":"string","description":"`observed_at` of the first and last interaction — the endpoint's clock."},"last_at":{"type":"string"},"machine_id":{"type":["string","null"],"description":"The machine of the most recent row that names one. `null` on a session\na connection ingested."},"os_user":{"type":["string","null"],"description":"The OS account, from the most recent row that carried one."},"session_id":{"type":"string"}}},"InteractionView":{"type":"object","required":["id","source","service","host","method","observed_at","received_at","request_bytes","response_bytes","capture_tactic","content_withheld","content_state","attachments","attachment_count","decisions","evaluated_by","decided_at_hook"],"properties":{"account_person_id":{"type":["string","null"],"description":"The person `service_account` names. The address is matched without\nregard to letter case. `null` where the row carries no service account,\nor where no person has ever been seen with it."},"action_kind":{"type":["string","null"],"description":"`hook` rows only: what the tool was doing (`prompt`, `shell`, `file_read`, `mcp_call`,\n`tool_use`, `session_start`)."},"attachment_count":{"type":"integer","format":"int32","description":"How many entries `attachments` holds.","minimum":0},"attachments":{"type":"array","items":{"$ref":"#/components/schemas/AttachmentView"},"description":"The files that rode this interaction, containers before members."},"can_reveal":{"type":["boolean","null"],"description":"Whether this caller may reveal them now: both grants, a key on this\ndeployment, and something held."},"capture":{"type":["string","null"],"description":"How it was captured: `network`, `extension` or `hook`. `null` on older\ninteractions recorded before capture was tracked."},"capture_tactic":{"type":"string"},"client_kind":{"type":["string","null"],"description":"Declared by the capture surface. `null` means nothing declared one, which\nis not the same as `other`."},"client_name":{"type":["string","null"],"description":"The tool's own name, e.g. `\"Claude Code\"`. Declared by the capture\nsurface, never inferred from a User-Agent. `client_kind` says what form\nof client it was; this tells one tool from another. `null` means no\ncapture surface declared a name, which is common, not that the tool is\nunknown."},"connection_id":{"type":["string","null"],"description":"The connection whose sync ingested this interaction. `null` on every\ninteraction a machine reported."},"content_state":{"$ref":"#/components/schemas/ContentState","description":"What happened to this row's prompt and response text, as one word:\n`withheld`, `dropped`, `pending`, `captured` or `not_captured`."},"content_withheld":{"type":"boolean","description":"**`true` only when content exists on this row and this caller may not\nsee it.**\n\nWithout it, a caller reads `null` previews and cannot tell *never\ncaptured* from *withheld from you*, and those are different facts about\ndifferent things: the first is a statement about the machine's capture\ntactic — nothing exists, nobody is being kept from anything — and the\nsecond is a statement about the reader. Rendering the second as the\nfirst tells an operator there is no content here when there is, which is\nthe kind of quiet inaccuracy that surfaces during an incident review.\n\n**Per row, not per response.** One page legitimately mixes both: a\nmetadata-tactic interaction beside a content-tactic one genuinely has\nnothing to withhold, and a response-level flag would mark it as withheld\nand be wrong about it.\n\n`false` for a caller holding `interaction_content:read`, and `false` for\na row that never had content to begin with. It is a fact about *this row\nand this reader*, so it is computed in the projection beside the\nredaction it describes — one place, which is the only way the two cannot\ndisagree."},"correlation_id":{"type":["string","null"],"description":"Joins a hook row to the network row the same call caused."},"decided_at_hook":{"type":"array","items":{"type":"string"},"description":"On a network row, the policies a tool's hook already decided for this\nprompt; the hook row shares this row's `correlation_id`. Filled on\n`GET /interactions/{id}`; empty on the list."},"decisions":{"type":"array","items":{"$ref":"#/components/schemas/DecisionView"},"description":"Everything decided about this interaction, oldest first. Empty means\nnothing has decided anything about it yet, since a later verdict can\nstill attach to it. Empty does not mean it passed: `evaluated_by` says\nwhether a policy checked it."},"endpoint":{"type":["string","null"],"description":"The path and query. `null` on some older interactions, which does not\nmean an empty path."},"evaluated_by":{"type":"array","items":{"$ref":"#/components/schemas/EvaluatedByView"},"description":"The policies that evaluated this interaction, whether or not they\nmatched: Enabled or Monitor policies whose conditions were checked.\nNon-empty with no objecting decision reads as *Allowed*; empty with no\ndecision reads as *Not evaluated*. Empty on older interactions."},"held_values":{"type":["integer","null"],"format":"int64","description":"How many originals are held (Restricted only)."},"host":{"type":"string"},"id":{"type":"string"},"log_redaction":{"type":["string","null"],"description":"The Redaction in logs mode this interaction's text was stored under.\nAbsent on the list; set on `GET /interactions/{id}`."},"machine_id":{"type":["string","null"],"description":"The machine that reported this interaction. `null` on an interaction a\nconnection ingested (a Copilot turn, say, was reported by no machine);\n`connection_id` is set exactly when this is `null`."},"method":{"type":"string"},"model":{"type":["string","null"],"description":"The model this request named, verbatim from the body, e.g.\n`gpt-4o-mini`, `auto`, `claude-opus-4-1`.\n\n`null` is common: some services (Gemini, Bedrock) name the model in the\nURL, and a model is never guessed from a host or an endpoint."},"observed_at":{"type":"string"},"os_user":{"type":["string","null"],"description":"The logged-in OS account. An identifiable person."},"prompt_kind":{"type":["string","null"],"description":"What the person did: `sent` (a message they submitted) or `draft`\n(text that left the machine while they were still typing it).\n`prompt_turns` says how many requests were folded into a draft.\n\nMetadata, returned without content access. `null` on some older\ninteractions."},"prompt_path":{"type":["string","null"],"description":"Where in the body the text came from — `messages[].content`. Provenance,\nshown beside the text, and what an operator uses to tell a real\nattribution from a lucky field name. A JSON address, not content."},"prompt_text":{"type":["string","null"],"description":"What the person actually typed, read out of the request. Content: it\nis returned only to a caller allowed to read interaction content.\n\nThree distinct answers. `null` with `prompt_tier` also `null` means the\nrequest was never read for a prompt (a metadata-only exchange, or an\nolder interaction). `\"\"` with a `prompt_tier` of `unknown_shape` or\n`undecodable` means it was read and held no prompt. `null` with a\n`prompt_tier` present means the caller may not see it, which\n`content_withheld` also says."},"prompt_tier":{"type":["string","null"],"description":"How `prompt_text` was found, and therefore how much to trust it:\n`known_shape`, `named_field`, `unknown_shape` or `undecodable`.\n\nMetadata, returned without content access: that a request carried a\nprompt is a fact like its endpoint or byte counts."},"prompt_turns":{"type":["integer","null"],"format":"int32","description":"How many requests folded into this row. `1` for a send; for a draft, the\nlength of the prefix chain — `5` for `sel`…`selamlar`.\n\n**Without it a collapsed draft looks like one request when it was\nfive**, and an operator asking how much this endpoint actually sent\nwould be off by the whole chain."},"received_at":{"type":"string"},"redacted_values":{"type":["integer","null"],"format":"int32","description":"How many values in the stored text were replaced or masked."},"request_bytes":{"type":"integer","format":"int64"},"request_preview":{"type":["string","null"],"description":"The start of the request body. Content.\n\n`null` does not mean the prompt was empty. Either content was never\ncaptured (the machine's capture tactic collects none, or no body was\nseen), or the caller is not allowed to read interaction content and it\nwas withheld. `content_withheld` tells the two apart."},"response_bytes":{"type":"integer","format":"int64"},"response_preview":{"type":["string","null"]},"service":{"type":"string"},"service_account":{"type":["string","null"],"description":"The address the AI service is signed in as. An identifiable person, and\n`null` is common: it is only visible under a content tactic."},"session_id":{"type":["string","null"],"description":"The AI service's own conversation id. `null` when unknown; one is\nnever made up."},"source":{"type":"string","description":"Which capture produced this row: `endpoint_agent` or `connector`. New\nvalues may be added; treat an unknown one as a label, not an error."},"user_person_id":{"type":["string","null"],"description":"The person signed in to the machine: the person whose presence matches\nthis row's machine and OS account.\n\nSeparate from `account_person_id`, because the account somebody uses\nfor the AI service may belong to a different person from the one\nsigned in to the machine. `null` where the row records no OS account,\nor where no person has been seen with that account on that machine yet."}}},"IssueGroupView":{"type":"object","description":"One group of issues: what the group is keyed on, and counts over its\nmembers. It names its key, never one of its issues.","required":["key_kind","key","count","worst","last_seen_at","sources","source_kinds","subjects","subject_kinds","rules"],"properties":{"count":{"type":"integer","format":"int64","description":"Issues in this group across the whole match, not a page of it."},"key":{"type":"string","description":"`source_id` or `subject_id`. Expanding the group is `listIssues` with\n`source~in~<key>` (or `subject~in~<key>`) added to `f`."},"key_kind":{"type":"string","description":"`source_kind` (`policy`, `engine`, `scanner`) or `subject_kind`\n(`artifact`, `machine`, …), by `by`."},"last_seen_at":{"type":"string","description":"The most recent `last_seen_at` in the group, RFC 3339."},"machine_name":{"type":["string","null"],"description":"Grouped by subject, the hostname of the machine an artifact is on: one\ntool on forty laptops is forty artifacts with one name."},"name":{"type":["string","null"],"description":"The key's own name: a policy's, an artifact's, a machine's hostname.\n`null` where it has none (an engine, a scanner, a deleted policy, a\nconnector record); use `key_kind` to describe those."},"rules":{"type":"integer","format":"int64","description":"How many different rules the group's issues were raised under: for an\nengine or a scanner, how many kinds of problem the group holds."},"source_kinds":{"type":"array","items":{"type":"string"},"description":"The source kinds among them, sorted."},"sources":{"type":"integer","format":"int64","description":"How many different sources raised the group's issues."},"subject_kinds":{"type":"array","items":{"type":"string"},"description":"The subject kinds among them, sorted."},"subjects":{"type":"integer","format":"int64","description":"How many different subjects the group's issues are about."},"worst":{"type":"string","description":"The worst severity in the group."}}},"IssueGroupsResponse":{"type":"object","required":["groups"],"properties":{"groups":{"type":"array","items":{"$ref":"#/components/schemas/IssueGroupView"},"description":"Worst severity first, then the larger group, then the key."}}},"IssueListResponse":{"type":"object","required":["issues","total","open","matched"],"properties":{"issues":{"type":"array","items":{"$ref":"#/components/schemas/IssueView"}},"matched":{"type":"integer","format":"int64","description":"How many issues match this filter and search, across every page. What\nthe list's position rail counts against; not what is left after the\ncursor."},"next_cursor":{"type":["string","null"],"description":"The `cursor` for the next page; `null` on the last one."},"open":{"type":"integer","format":"int64","description":"How many are open. The count beside the page title."},"total":{"type":"integer","format":"int64","description":"Every issue this workspace holds, whatever the filter."}}},"IssueTamperView":{"type":"object","required":["machine_id","events"],"properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/TamperEventView"},"description":"The events behind this issue, newest first: those received since the issue was first\nseen, at most 200."},"hostname":{"type":["string","null"],"description":"Its hostname; `null` if the workspace no longer holds the row."},"machine_id":{"type":"string","description":"The machine the issue is about."}}},"IssueView":{"type":"object","required":["id","kind","severity","title","source_kind","source_id","subject_kind","subject_id","rule","tags","status","first_seen_at","last_seen_at"],"properties":{"evidence":{"type":["array","null"],"items":{"$ref":"#/components/schemas/EvidenceView"},"description":"For an issue an AI-tool policy raised: each item the policy matched in\nthe tool's latest settings read, with the file, its scope and project,\nthe vendor's key, and the item. Recomputed on every\n`GET /issues/{id}`, so it never shows a match that no longer holds.\nAbsent on the list and on issues no AI-tool policy raised; empty when\nthe policy no longer matches the latest read."},"first_seen_at":{"type":"string"},"id":{"type":"string"},"kind":{"type":"string"},"last_seen_at":{"type":"string"},"person_id":{"type":["string","null"],"description":"The person this issue is about.\n\nOnly two subject kinds carry a person: a `connection_record` that is a\nperson's account, and an `os_user`. An issue about an artifact or a\nmachine always has `null` here."},"recommendation":{"type":["string","null"],"description":"The suggested fix, as a paragraph. `null` where none is proposed;\ntoday only `machine_tamper` issues carry one."},"resolved_at":{"type":["string","null"]},"rule":{"type":"string"},"severity":{"type":"string"},"source_id":{"type":"string"},"source_kind":{"type":"string","description":"What raised this issue: `engine`, `policy` or `scanner`; `source_id`\nsays which one. Both are always present."},"status":{"type":"string"},"subject_id":{"type":"string"},"subject_kind":{"type":"string"},"subject_name":{"type":["string","null"],"description":"The subject's own name where it has one. `null` for a subject that is\nnot an artifact, or one that has since been removed — an issue outlives\nits artifact, because \"what was wrong with the file that used to be\nhere\" stays worth asking."},"summary":{"type":["string","null"]},"system_resolution":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SystemResolutionView","description":"Present only where Oxelone itself closed this issue, saying who and\nwhy; `null` when a person closed it (see `resolved_at`).\n\nIt is cleared when a person changes the issue's status, or when the\nissue reopens."}]},"tags":{"type":"array","items":{"type":"string"},"description":"The free-text labels somebody put on **this issue** — not on the\nartifact it is about, which carries its own set. Present on the list so\na queue renders them without a second call per row."},"title":{"type":"string"}}},"JudgeConditionView":{"type":"object","description":"One judge — the workspace's own, or a built-in scanner — and what a policy\nmay ask about it.\n\nA policy filter reads `judge:<id>.<field>`. Judges are keyed on the id,\nnot the name, so renaming a judge does not detach the policies that use\nit. `fields` is the judge's declared output, typed; `output_schema` is the\nstored schema as written.","required":["id","name","enabled","builtin","fields","paths","output_schema","availability"],"properties":{"applies_to":{"type":"array","items":{"type":"string"},"description":"The artifact kinds this judge or scanner can be asked about.\n\n**A built-in scanner names exactly one**: the Skill Scanner reads a\nskill, and offering it on a policy watching MCP servers would be a row\nwhose invocation never runs. A workspace own judge reads whatever text it\nis given, so it names every kind that has some."},"availability":{"$ref":"#/components/schemas/EngineAvailabilityView","description":"Whether **this judge** will answer, over the model it runs on: its own\nwhen it names one, else the workspace's default. The engine's own\n`availability` can read available while a judge's does not — one judge\nwith a model of its own keeps the engine answering, and a filter that\nreads another judge still gets nothing."},"builtin":{"type":"boolean","description":"Whether this is a built-in scanner: always enabled, with output read\nthrough `paths` (the `findings`, `kinds` and `count.*` keys), and only\noffered for Host policies."},"enabled":{"type":"boolean","description":"**A disabled judge is listed and flagged, not omitted.** It contributes\nno fact rather than a passing one, and an author looking for a rubric\nthey wrote last week must find it here rather than conclude it is gone."},"fields":{"type":"array","items":{"$ref":"#/components/schemas/FieldControl"},"description":"The declared fields, typed, with the comparisons each allows.\n\nEmpty when the judge's stored schema no longer loads — such a judge\nnever runs, and the judge list says the same. Also empty for a built-in\nscanner, whose readable values are in `paths`."},"id":{"type":"string","description":"A workspace judge's uuid, or a built-in scanner's id (`skill`, …) — the\ninvocation selector a policy row names."},"name":{"type":"string"},"output_schema":{"description":"The judge's own `output_schema`, verbatim, as pinned."},"paths":{"type":"array","items":{"type":"string"},"description":"For a built-in scanner: the dotted paths a policy filter may read\n(`kinds`, `count.total`, `count.critical`, …). Empty for a workspace\njudge, whose readable values are in `fields`."}}},"KeyKindView":{"type":"object","description":"A secrets rule's identity: `github-pat`, *GitHub personal access token*.","required":["id","label"],"properties":{"id":{"type":"string"},"label":{"type":"string"}}},"LabelView":{"type":"object","description":"One label an engine's vocabulary holds.","required":["id","display","description","emittable"],"properties":{"description":{"type":"string"},"display":{"type":"string"},"emittable":{"type":"boolean","description":"Whether the backend this workspace selected can emit it. **A `false`\nhere is a condition that evaluates to a confident `false` rather than to\nunknown**, so the editor lists it and does not offer it."},"id":{"type":"string","description":"The label's id, as a policy's engine-label filter names it."}}},"LastCrashView":{"type":"object","description":"The newest crash this machine's agent reported.","required":["at","thread","message"],"properties":{"at":{"type":"string","description":"RFC 3339."},"message":{"type":"string"},"thread":{"type":"string"}}},"LaunchView":{"type":"object","description":"How an MCP server is launched or reached. Everything here was made safe on\nthe machine before it was sent: a key-shaped value is redacted, and a URL is\nstripped of userinfo, query and fragment.","required":["env_names","header_names"],"properties":{"command":{"type":["string","null"],"description":"The launcher and the package it runs, e.g. `npx @playwright/mcp@1.2.3`."},"env_names":{"type":"array","items":{"type":"string"},"description":"Names of the environment variables the server is given, as far as its\nlaunch arguments show them (`-e NAME`); never values."},"header_names":{"type":"array","items":{"type":"string"},"description":"Names of the request headers the server is given (`--header Name`);\nnever values."},"transport":{"type":["string","null"],"description":"`stdio`, `http` or `sse`."},"url":{"type":["string","null"]}}},"LayoutItemView":{"type":"object","description":"One item on a tab's top level.","required":["kind","id"],"properties":{"id":{"type":"string","description":"The group's id, or the policy's (own or provided)."},"kind":{"type":"string","description":"`group` or `policy`."}}},"LimitationView":{"type":"object","description":"One thing this workspace's fleet cannot do for this policy.\n\n`code` is stable and machine-readable; `message` is a sentence for the\npolicy's author, meant to be shown as it is.","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"}}},"ListDiagnosticsResponse":{"type":"object","required":["diagnostics","total"],"properties":{"diagnostics":{"type":"array","items":{"$ref":"#/components/schemas/DiagnosticsSummaryView"}},"next_cursor":{"type":["string","null"],"description":"Pass back as `cursor` for the next page. `null` means this was the last."},"total":{"type":"integer","format":"int64","description":"How many bundles the filter matched in all, not just on this page."}}},"ListMachineNamesResponse":{"type":"object","required":["machines","total"],"properties":{"machines":{"type":"array","items":{"$ref":"#/components/schemas/MachineNameView"}},"total":{"type":"integer","format":"int64","description":"How many machines are in the fleet: the length of `machines`, since this\nlist is never paged."}}},"ListMachinesResponse":{"type":"object","required":["machines","total"],"properties":{"machines":{"type":"array","items":{"$ref":"#/components/schemas/MachineView"}},"next_cursor":{"type":["string","null"],"description":"Pass back as `cursor` for the next page. `null` means this was the last."},"total":{"type":"integer","format":"int64","description":"How many machines the filter matched in all, not just on this page."}}},"ListPoliciesResponse":{"type":"object","required":["policies","hit_counts","groups"],"properties":{"groups":{"type":"array","items":{"$ref":"#/components/schemas/GroupView"},"description":"Every policy group this workspace sees, those provided by Oxelone and\nits own, of every type, in reading order. A policy row's `group_id`\nnames the group it is in, `null` when it is in none."},"hit_counts":{"type":"array","items":{"$ref":"#/components/schemas/PolicyHitCountView"},"description":"How many decisions each policy has ever produced — a filter match,\nwhatever the outcome or the state — with its trailing seven days, day\nby day. One entry per policy that has any; a policy with none is absent."},"policies":{"type":"array","items":{}}}},"ListRemovedResponse":{"type":"object","required":["policies"],"properties":{"policies":{"type":"array","items":{}}}},"MachineActivityResponse":{"type":"object","required":["days"],"properties":{"days":{"type":"array","items":{"$ref":"#/components/schemas/ActivityDayView"},"description":"Oldest first, **zero-filled**: the quiet days are data, not gaps."}}},"MachineAddressesResponse":{"type":"object","description":"A machine's two address histories, each newest first, kept apart.\n\n*Reported* is the agent's own egress address: which subnet the machine is\non. *Observed* is what the server saw: which network it connected from.\n\n**Both are personal data, and a history of them is a movement trace.**","required":["reported","observed","cap"],"properties":{"cap":{"type":"integer","format":"int64","description":"How many changes of **each** kind are kept for a machine. A list this\nlong has had older changes dropped."},"observed":{"type":"array","items":{"$ref":"#/components/schemas/AddressChangeView"},"description":"What the server saw the connection arrive from."},"reported":{"type":"array","items":{"$ref":"#/components/schemas/AddressChangeView"},"description":"What the agent said its own primary egress interface was."}}},"MachineCollectionResponse":{"type":"object","required":["counts","rows"],"properties":{"counts":{"$ref":"#/components/schemas/ContentRequestCountsView"},"rows":{"type":"array","items":{"$ref":"#/components/schemas/ContentRequestRowView"}}}},"MachineConnectionsResponse":{"type":"object","required":["window_hours","tools","services","total_tools","total_services"],"properties":{"services":{"type":"array","items":{"$ref":"#/components/schemas/ConnectionServiceView"},"description":"Largest first, at most 20."},"tools":{"type":"array","items":{"$ref":"#/components/schemas/ConnectionToolView"},"description":"Largest first, at most 20."},"total_services":{"type":"integer","format":"int64","description":"As `total_tools`, for services."},"total_tools":{"type":"integer","format":"int64","description":"How many distinct tools were in the window, including any past the 20\nthe list stops at."},"window_hours":{"type":"integer","format":"int32","description":"The window actually used, after the clamp."}}},"MachineDetailView":{"type":"object","description":"One machine, and the counts its details page opens with. `machine` has the\nsame shape as a row of the machines list.","required":["machine","config","surfaces","tool_hooks","tool_restrictions","survey","steering_notes","artifact_count","artifacts_with_issues","scan_count"],"properties":{"artifact_count":{"type":"integer","format":"int64","description":"Every artifact this machine has reported, **in any state** — `gone` and\n`out_of_scope` included."},"artifacts_with_issues":{"type":"integer","format":"int64","description":"How many of those artifacts carry an **unresolved** issue. Counts\nartifacts, not issues: two issues on one file count once."},"browsers":{"type":["array","null"],"items":{"$ref":"#/components/schemas/BrowserView"},"description":"One row per browser the agent reported, `state` worked out when the\nrequest is answered. `null` when never reported, which is not the same\nas \"no browsers\"."},"config":{"type":"array","items":{"$ref":"#/components/schemas/ConfigSectionView"},"description":"The ten configuration sections and whether each is applied, in a fixed\norder. Empty before the machine first checks in."},"environment":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/EnvironmentView","description":"The network the machine last reported; null when it has not reported\none (an older agent)."}]},"last_crash":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/LastCrashView","description":"The newest crash the agent reported, or null if it never has."}]},"last_scan":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ScanRunView","description":"Its most recent scan, or null if it has **never scanned**. A scan that\nfound nothing is present here with `changed_something: false`."}]},"machine":{"$ref":"#/components/schemas/MachineView"},"profile":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/MachineProfileView","description":"The baseline this machine inherits from: its enrollment profile's own\nsettings, by name. Null for a machine enrolled without a profile."}]},"replaced_by":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/MachineRef","description":"The newest install that replaced this machine, or null."}]},"replaces":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/MachineRef","description":"The machine this install replaced, or null."}]},"scan_count":{"type":"integer","format":"int64","description":"Scan runs **surviving retention**, not runs ever recorded: quiet runs\npast the last few per kind are pruned, so this is the number of rows a\nreader can actually open."},"steering":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SteeringView","description":"What this machine's capture tactic is **actually doing**, as the machine\nitself last reported it. `capture_strategies` says what the machine may\ndo and `enabled_strategies` what is switched on; neither says whether\nany of it succeeded. This does.\n\n**`null` means never reported, not that nothing failed**: an older\nagent does not send it."}]},"steering_notes":{"type":"array","items":{"$ref":"#/components/schemas/SteeringNoteView"},"description":"Facts about steering that are not problems: the surfaces' first, then\na second TLS inspector."},"surfaces":{"type":"array","items":{"$ref":"#/components/schemas/SurfaceView"},"description":"One per surface the machine reported, in `root, pac, routes`\norder. Empty when not reported."},"survey":{"type":"array","items":{"$ref":"#/components/schemas/SurveyFindingView"},"description":"What else the agent found intercepting. Empty when not reported or none."},"tool_coverage":{"type":["array","null"],"items":{"$ref":"#/components/schemas/ToolCoverageView"},"description":"The AI tools the machine last reported, in the order its agent reported\nthem, with each layer and its gap counts. `null` when the agent has not\nreported any, which is not the same as \"no tools\"."},"tool_coverage_observed_at":{"type":["string","null"],"description":"RFC 3339: when this server stored `tool_coverage`."},"tool_hooks":{"$ref":"#/components/schemas/ToolHooksView","description":"The **effective** hooks section: this machine's own or else its profile's, all five\ntools present."},"tool_hooks_override":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ToolHooksView","description":"This machine's own hooks section alone, or `null` when it follows its profile."}]},"tool_restrictions":{"$ref":"#/components/schemas/ToolRestrictionsView","description":"The **effective** restrictions: this machine's own or else its profile's."},"tool_restrictions_override":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ToolRestrictionsView","description":"This machine's own restrictions alone, or `null` when it follows its profile."}]},"worst_issue_severity":{"type":["string","null"],"description":"The worst **unresolved** severity across them, or null when nothing is\nopen. Ranked, never sorted alphabetically — that puts `critical` after\n`high` and `low` before `medium`, wrong in both directions at once."}}},"MachineHealthView":{"type":"string","description":"The health of an active machine. Only an `active` machine has one;\n`installing` and `stuck` are lifecycle values, not health. `unreachable` is\nworked out when the request is answered.","enum":["unreachable","paused","degraded","healthy"]},"MachineNameView":{"type":"object","description":"One machine's name, and nothing else about it.","required":["id","hostname"],"properties":{"hostname":{"type":"string"},"id":{"type":"string"}}},"MachineProfileRef":{"type":"object","description":"The enrollment profile a machine enrolled through, by name.","required":["id","name"],"properties":{"id":{"type":"string"},"name":{"type":"string"}}},"MachineProfileView":{"type":"object","description":"One enrollment profile's settings, as a machine's page names them.","required":["name","log_level","scan"],"properties":{"log_level":{"type":"string"},"name":{"type":"string"},"scan":{"$ref":"#/components/schemas/ScanConfigView"}}},"MachineRef":{"type":"object","description":"Another machine, by ID, hostname and lifecycle. A `deleted` one can no\nlonger be read.","required":["id","hostname","lifecycle"],"properties":{"hostname":{"type":"string"},"id":{"type":"string"},"lifecycle":{"type":"string"}}},"MachineUpdateHistoryView":{"allOf":[{"$ref":"#/components/schemas/MachineUpdateView"},{"type":"object","required":["scope","started_at"],"properties":{"scope":{"type":"string","description":"The rollout's scope: `profile` | `machine`."},"started_at":{"type":"string"},"started_by":{"type":["string","null"],"description":"`null` when the sweep started it (automatic update)."}}}],"description":"One row of a machine's update history."},"MachineUpdateView":{"type":"object","description":"One machine's update, as every read and write returns it.","required":["id","rollout_id","machine_id","hostname","os","from_version","target_version","state","attempt","partial","phase_at","updated_at"],"properties":{"attempt":{"type":"integer","format":"int32","description":"1 for the first try; each retry adds one."},"from_version":{"type":"string"},"hostname":{"type":"string"},"id":{"type":"string"},"last_error":{"type":["string","null"],"description":"Why it failed or was skipped or cancelled, in a sentence."},"machine_id":{"type":"string"},"next_retry_at":{"type":["string","null"],"description":"When the next automatic retry is due; `null` when none is."},"os":{"type":"string","description":"The machine's OS, as it reports it: `windows` | `macos` | `linux`."},"outcome":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UpdateOutcomeView","description":"What the update did on the machine, as its agent reported once the\nupdate was whole. `null` until it does — and always, for an agent\nolder than the report."}]},"partial":{"type":"boolean","description":"The update reached its version and left something undone: a reconcile\nstep `failed`, `interrupted` or `deferred`, a retired file `failed`,\nor a component `skipped`. `false` while `outcome` is `null`."},"phase_at":{"type":"string","description":"When `state` last changed."},"rollout_id":{"type":"string"},"skip_reason":{"type":["string","null"],"description":"Why a `skipped` machine was skipped: `no_build` (the release has no\nagent build for its OS), `needs_reinstall` (it runs a version too old\nto update in place) or `ahead` (it already runs something newer).\n`null` on every other state."},"state":{"type":"string","description":"`waiting` | `downloading` | `verifying` | `installing` | `awaiting` |\n`updated` | `failed` | `cancelled` | `skipped`."},"target_version":{"type":"string","description":"What this machine is moving to: the default build of its OS when the\nrollout started."},"updated_at":{"type":"string"}}},"MachineView":{"type":"object","required":["id","hostname","os","os_version","agent_version","capture_tactic","capture_strategies","enabled_strategies","lifecycle","health_reasons","pauses","enrolled_at","is_paused","users","tools"],"properties":{"agent_version":{"type":"string"},"attachment_encrypted_archives":{"type":["string","null"],"description":"The per-machine attachment **overrides**; `null` means the machine\ninherits the setting from its profile."},"attachment_fail_mode":{"type":["string","null"]},"browsers":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/BrowserSummary","description":"How many of the machine's browsers are `reporting`, of how many it\nreported. **`null` means never reported** (an older agent, or a machine\nwhose `extension` strategy has never been on), which is different from\n`0 of 0`."}]},"bundle_hash":{"type":["string","null"]},"capture_strategies":{"type":"array","items":{"$ref":"#/components/schemas/CaptureStrategyView"},"description":"What this machine is enrolled to be capable of. Immutable."},"capture_tactic":{"$ref":"#/components/schemas/CaptureTacticView","description":"Worked out from `capture_strategies`."},"collect_artifact_content":{"type":["boolean","null"],"description":"The per-machine content-collection **override**; `null` means the\nmachine inherits its profile's switch. Decides whether file contents may\nbe collected from this machine."},"companion_version":{"type":["string","null"],"description":"The companion version the machine last reported. `null` means not\nreported yet, not \"no companion\"."},"disabled_strategies":{"type":["array","null"],"items":{"type":"string"},"description":"The machine's own disabled-strategy block, `null` when it follows the\nprofile; `enabled_strategies` above is the materialised result."},"enabled_strategies":{"type":"array","items":{"$ref":"#/components/schemas/CaptureStrategyView"},"description":"Which of them are running. Mutable, per strategy."},"enrolled_at":{"type":"string"},"health":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/MachineHealthView","description":"`null` unless `lifecycle` is `active`."}]},"health_reasons":{"type":"array","items":{"$ref":"#/components/schemas/HealthReasonView"},"description":"Most severe first; non-empty only when `health` is `degraded`. On a\nlist row this is the beat-time snapshot; on the detail view it is\nrecomputed when the request is read."},"hostname":{"type":"string"},"id":{"type":"string"},"is_paused":{"type":"boolean","description":"Whether this machine is paused **as of this response**, worked out from\n`paused_until` by the server."},"last_seen_at":{"type":["string","null"],"description":"RFC 3339, or null if the machine has never checked in."},"lifecycle":{"type":"string","description":"`active | installing | stuck | suspended | uninstalled | archived | deleted`.\nA list never carries `deleted`."},"log_level":{"type":["string","null"],"description":"The per-machine log-level **override**, or null when this machine\ninherits its enrollment profile's level."},"machine_group":{"type":["string","null"]},"observed_address":{"type":["string","null"],"description":"The address the server last saw this machine's requests arrive from.\n`null` before its first beat.\n\n**Personal data and a coarse location signal**: it names the network a\nmachine connects from. Same grant as above."},"os":{"type":"string"},"os_version":{"type":"string"},"panel_show_collection":{"type":["boolean","null"]},"panel_show_steering":{"type":["boolean","null"],"description":"The per-machine panel **overrides**; `null` means the machine inherits\nthe setting from its profile."},"paused_until":{"type":["string","null"],"description":"When this machine's user paused enforcement until, as it last reported.\n`null` means enforcing, which almost every machine almost always is.\n\n**A value in the past is stale, not paused**: the agent resumes on its\nown clock and clears the field when it next checks in. Read `is_paused`\nrather than comparing this to the current time yourself."},"pauses":{"type":"array","items":{"$ref":"#/components/schemas/PauseView"},"description":"Live pauses, all three scopes."},"profile":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/MachineProfileRef","description":"The enrollment profile this machine enrolled through, or null when it\nenrolled without one or the profile was deleted."}]},"reported_address":{"type":["string","null"],"description":"The machine's own primary egress address, as it last reported one.\n`null` means it never has: either its agent is too old to report one, or\nit could not determine an address.\n\n**Personal data.** Readable by anyone who can read machines."},"reported_log_level":{"type":["string","null"],"description":"What the agent last said it is **actually running at**, or null when it\nhas never said — an agent from before the field, which must render as\n*not reported* rather than as obeying the assertion."},"scan_categories":{"type":["array","null"],"items":{"type":"string"}},"scan_enabled":{"type":["boolean","null"],"description":"This machine's scan **override**, not the configuration it is running.\n`null` on any `scan_*` field means the machine inherits that field from\nthe enrollment profile it enrolled through."},"scan_full_hours":{"type":["integer","null"],"format":"int32"},"scan_max_depth":{"type":["integer","null"],"format":"int32"},"scan_max_files":{"type":["integer","null"],"format":"int32"},"scan_roots":{"type":["array","null"],"items":{"type":"string"}},"scan_skips":{"type":["array","null"],"items":{"type":"string"}},"scan_smart_minutes":{"type":["integer","null"],"format":"int32"},"suspended_at":{"type":["string","null"],"description":"RFC 3339 when Suspend was pressed, else null."},"tool_hooks":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ToolHooksView","description":"This machine's own hooks section, which replaces its profile's section\nas a whole; `null` means it follows the profile. The **effective**\nsection is on the single-machine view."}]},"tool_restrictions":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ToolRestrictionsView","description":"This machine's own tool restrictions, which replace its profile's as a\nwhole; `null` means it follows the profile."}]},"tools":{"type":"array","items":{"$ref":"#/components/schemas/ToolBadge"},"description":"AI tools the machine reported present, in the order its agent reported\nthem. Empty when it has reported none."},"uninstalled_at":{"type":["string","null"],"description":"RFC 3339 when the agent reported its local uninstall, else null."},"users":{"type":"array","items":{"type":"string"},"description":"OS logins with a live presence on this machine, newest first.\n**Personal data**, readable by anyone who can read machines."}}},"MarketplaceRefView":{"type":"object","required":["name","source","plugins_installed"],"properties":{"allowed":{"type":["boolean","null"],"description":"`null`: no allowlist or blocklist is enforced. `false`: blocked or not allowlisted."},"name":{"type":"string"},"plugins_installed":{"type":"integer","format":"int32","minimum":0},"source":{"$ref":"#/components/schemas/MarketplaceSourceView"}}},"MarketplaceSourceView":{"type":"object","required":["kind","locator"],"properties":{"kind":{"type":"string","description":"`github` | `git` | `url` | `file` | `directory` | `other`."},"locator":{"type":"string","description":"`owner/repo`, a host, a location, or empty."}}},"ModeResultView":{"type":"object","description":"What became of one id in a bulk mode change.","required":["id","outcome"],"properties":{"id":{"type":"string"},"mode":{"type":["string","null"],"description":"The mode it is in after this change — `enforce` where `monitor` was asked\nfor and the policy holds nothing back — or `null` when it was refused or\nnot found."},"outcome":{"type":"string","description":"`changed`, `unchanged` (it already had that mode), `refused` (see\n`refusal`; nothing was written for it), or `not_found`."},"refusal":{"type":["string","null"],"description":"Why it was refused, as a sentence, or `null`."}}},"ModeSpanView":{"type":"object","required":["mode","at"],"properties":{"at":{"type":"string"},"mode":{"type":"string"}}},"MuteListResponse":{"type":"object","required":["mutes"],"properties":{"mutes":{"type":"array","items":{"$ref":"#/components/schemas/MuteView"},"description":"Live only — neither expired nor lifted. The question this answers is\n*what is being silenced right now*, and a list mixing in last quarter's\nis one nobody can read the answer off. The audit log is where an expired\nmute is still visible."}}},"MuteRequest":{"type":"object","required":["reason","expires_at"],"properties":{"expires_at":{"type":["string","null"],"description":"When it lifts, RFC 3339. Must be in the future and within 90 days.\n\nRequired, and may be `null`: `null` holds the mute until somebody lifts\nit. Leaving the field out is a 400, so a missing date never silences an\nissue forever by accident."},"reason":{"type":"string","description":"Why this is being silenced. Required, and it is the whole reason the\nmechanism is safe to have."}}},"MuteView":{"type":"object","description":"One live mute, as the review list shows it.","required":["id","subject_kind","subject_id","source_kind","source_id","rule","reason","created_at","expires_at"],"properties":{"created_at":{"type":"string"},"created_by":{"type":["string","null"],"description":"Who silenced it. `null` only if the user row is gone, which\n`ON DELETE RESTRICT` exists to prevent — optional so a reader is never a\n`NOT NULL` promise away from a 500."},"expires_at":{"type":["string","null"],"description":"When it lifts on its own. Always within 90 days of `created_at`.\n`null`: it holds until somebody lifts it."},"id":{"type":"string"},"reason":{"type":"string","description":"Why, in the words of whoever muted it. Never empty."},"rule":{"type":"string"},"source_id":{"type":"string"},"source_kind":{"type":"string"},"subject_id":{"type":"string"},"subject_kind":{"type":"string","description":"What this mute silences, with `subject_id`, `source_kind`, `source_id`\nand `rule`: compare these against an issue's own fields to tell whether\nit is muted."}}},"NameMatchView":{"type":"object","description":"A marketplace entry that shares the name and nothing more is known.","required":["feed","name","content_matches"],"properties":{"content_matches":{"type":"boolean","description":"The candidate's content hash matched this artifact's. Only a lockfile's\nrecorded source or this makes a skill *Matches upstream*."},"feed":{"type":"string"},"installs":{"type":["integer","null"],"format":"int64"},"link":{"type":["string","null"]},"name":{"type":"string"}}},"NotInspectedView":{"type":"object","description":"Why a decision's interaction had no content inspected, and the numbers.","required":["reason","size_bytes","cap_bytes"],"properties":{"cap_bytes":{"type":"integer","format":"int64","minimum":0},"reason":{"type":"string","description":"`too_large`, `decompressed_too_large`, `hold_budget` or `parse_budget`."},"size_bytes":{"type":"integer","format":"int64","minimum":0}}},"OpenByKindView":{"type":"object","required":["kind","open"],"properties":{"kind":{"type":"string"},"open":{"type":"integer","format":"int64"}}},"OpenBySeverityView":{"type":"object","description":"Open issues by severity. Every key is always present.","required":["critical","high","medium","low","info"],"properties":{"critical":{"type":"integer","format":"int64"},"high":{"type":"integer","format":"int64"},"info":{"type":"integer","format":"int64","description":"Open issues of `info` severity."},"low":{"type":"integer","format":"int64"},"medium":{"type":"integer","format":"int64"}}},"OperatorView":{"type":"object","description":"One comparison a field offers: `id` is what a policy body carries, `label`\nis how it reads.","required":["id","label","arity"],"properties":{"arity":{"type":"string","description":"How many values this comparison takes: `one` | `pattern` | `many` |\n`number` | `window`. The same field takes one value under `is` and a\nlist under `in`."},"id":{"type":"string","description":"The comparison's name in a policy body: `is`, `is_not`, `in`, `not_in`,\n`contains`, `matches`, `gte`, `between`, and so on."},"label":{"type":"string","description":"What the comparison reads as: *is any of*, *does not contain*, *is at\nleast*."}}},"OverviewDayView":{"type":"object","description":"One UTC day.","required":["day","interactions","request_bytes","passed","alerted","blocked","undetermined","justified"],"properties":{"alerted":{"type":"integer","format":"int64"},"blocked":{"type":"integer","format":"int64"},"day":{"type":"string","description":"`YYYY-MM-DD`."},"interactions":{"type":"integer","format":"int64","description":"Interactions observed that day."},"justified":{"type":"integer","format":"int64"},"passed":{"type":"integer","format":"int64"},"request_bytes":{"type":"integer","format":"int64","description":"Bytes sent that day."},"undetermined":{"type":"integer","format":"int64"}}},"OverviewEdgeView":{"type":"object","description":"One tool → service pair among the listed tools and services.","required":["tool","service","interactions","blocked"],"properties":{"blocked":{"type":"integer","format":"int64"},"interactions":{"type":"integer","format":"int64"},"service":{"type":"string"},"tool":{"type":"string"}}},"OverviewIssuesView":{"type":"object","required":["total","open","open_by_severity","open_by_kind"],"properties":{"open":{"type":"integer","format":"int64","description":"Issues whose status is `open`."},"open_by_kind":{"type":"array","items":{"$ref":"#/components/schemas/OpenByKindView"},"description":"Largest first."},"open_by_severity":{"$ref":"#/components/schemas/OpenBySeverityView"},"total":{"type":"integer","format":"int64","description":"Every issue in the workspace, whatever its status."}}},"OverviewServiceView":{"type":"object","required":["service","catalogued","interactions","machines","request_bytes","blocked"],"properties":{"blocked":{"type":"integer","format":"int64","description":"Interactions with at least one `blocked` decision, each once."},"catalogued":{"type":"boolean","description":"Whether an enabled catalogue entry matches: its `service_id` equals\n`service`, or one of its patterns covers it (hook and proxy rows record\na host). False is Shadow AI."},"display_name":{"type":["string","null"],"description":"The catalogue's name for it; null when uncatalogued."},"interactions":{"type":"integer","format":"int64"},"machines":{"type":"integer","format":"int64","description":"Distinct machines that talked to it."},"request_bytes":{"type":"integer","format":"int64"},"service":{"type":"string","description":"The AI service, as interactions record it, e.g. `claude.ai`."},"vendor":{"type":["string","null"],"description":"The catalogue's vendor; null when uncatalogued or not recorded."}}},"OverviewToolView":{"type":"object","required":["name","interactions","blocked"],"properties":{"blocked":{"type":"integer","format":"int64"},"interactions":{"type":"integer","format":"int64"},"kind":{"type":["string","null"],"description":"The commonest declared client kind among its interactions."},"name":{"type":"string","description":"The client's declared name; its `client_kind` word when it declared\nnone; `other` when neither — the machine map's naming."}}},"OverviewTotalsView":{"type":"object","required":["interactions","request_bytes","blocked","services","shadow_services","machines_reporting"],"properties":{"blocked":{"type":"integer","format":"int64","description":"Interactions with at least one `blocked` decision, each counted once."},"interactions":{"type":"integer","format":"int64","description":"Interactions observed in the window."},"machines_reporting":{"type":"integer","format":"int64","description":"Distinct machines among the interactions. Connection-ingested\ninteractions have no machine and are not counted here."},"request_bytes":{"type":"integer","format":"int64","description":"Bytes sent to AI services in the window."},"services":{"type":"integer","format":"int64","description":"Distinct AI services."},"shadow_services":{"type":"integer","format":"int64","description":"Distinct AI services no enabled catalogue entry matches, by id or by\npattern: Shadow AI. Counted over every service, not only the listed."}}},"PackageCardView":{"type":"object","description":"What a package is (board 1's *Package card*).","required":["ecosystem","name","identity"],"properties":{"ai_role":{"type":["string","null"],"description":"Agent framework, Model SDK, … from AI scope."},"ecosystem":{"type":"string"},"identity":{"type":"string","description":"The match key, e.g. `pkg:pypi/langchain-community`."},"latest":{"type":["string","null"]},"licence":{"type":["string","null"]},"name":{"type":"string"},"public_page":{"type":["string","null"]},"publisher":{"type":["string","null"]},"range":{"type":["string","null"],"description":"The declared range, when the manifest named one."},"repository":{"type":["string","null"]},"version":{"type":["string","null"],"description":"The resolved version (a lockfile's, or a pin)."}}},"PauseView":{"type":"object","description":"One live pause.","required":["scope","until"],"properties":{"scope":{"type":"string","description":"`enforcement` | `scans` | `capture`."},"until":{"type":"string","description":"RFC 3339."}}},"PersonFacetsView":{"type":"object","description":"The four facets, each counting **people** over the whole matched set.","required":["vendor","source","enterprise","corporate_address"],"properties":{"corporate_address":{"type":"array","items":{"$ref":"#/components/schemas/FacetCountView"}},"enterprise":{"type":"array","items":{"$ref":"#/components/schemas/FacetCountView"}},"source":{"type":"array","items":{"$ref":"#/components/schemas/FacetCountView"}},"vendor":{"type":"array","items":{"$ref":"#/components/schemas/FacetCountView"}}}},"PersonListResponse":{"type":"object","required":["people","total","group","facets"],"properties":{"facets":{"$ref":"#/components/schemas/PersonFacetsView"},"group":{"type":"string","description":"The grouping this page was ordered by, echoed from the request."},"next_cursor":{"type":["string","null"],"description":"Pass back as `cursor` for the next page. `null` means this was the last."},"people":{"type":"array","items":{"$ref":"#/components/schemas/PersonListView"}},"total":{"type":"integer","format":"int64","description":"Every person the filter matched, across all pages, not only this one."}}},"PersonListView":{"type":"object","description":"One row of the Accounts list: a person, and every presence folded into them.","required":["id","display","identity_kind","presence_count","machine_count","sources","verdicts","corporate_address","first_seen_at","last_seen_at"],"properties":{"corporate_address":{"type":"boolean","description":"True when any presence sits on a domain the workspace owns."},"display":{"type":"string","description":"What the page calls them — an address, a login, or `HOST\\user`."},"first_seen_at":{"type":"string"},"group_key":{"type":["string","null"],"description":"The value `?group=` ordered on, or `null` when this person has none.\n**`null` is a real group** — a person with no domain is still a person."},"id":{"type":"string"},"identity_kind":{"type":"string","description":"`email`, `github_login` or `os_user`."},"last_seen_at":{"type":"string"},"machine_count":{"type":"integer","format":"int64"},"presence_count":{"type":"integer","format":"int64"},"sources":{"type":"array","items":{"$ref":"#/components/schemas/SourceMarkView"}},"verdicts":{"$ref":"#/components/schemas/VerdictSummaryView"}}},"PersonMachineView":{"type":"object","description":"One machine this person was seen on.","required":["machine_id","hostname","presences"],"properties":{"hostname":{"type":"string"},"machine_id":{"type":"string"},"presences":{"type":"integer","format":"int64","description":"How many of this person's presences sit on it."}}},"PersonView":{"type":"object","required":["id","display","identity_kind","identity_key","first_seen_at","last_seen_at","resolved_at","presences","machines"],"properties":{"display":{"type":"string"},"first_seen_at":{"type":"string"},"id":{"type":"string"},"identity_key":{"type":"string"},"identity_kind":{"type":"string"},"last_seen_at":{"type":"string"},"machines":{"type":"array","items":{"$ref":"#/components/schemas/PersonMachineView"}},"presences":{"type":"array","items":{"$ref":"#/components/schemas/PresenceView"}},"resolved_at":{"type":"string","description":"When the resolver last rebuilt this person."}}},"PluginBringsView":{"type":"object","required":["skills","commands","agents"],"properties":{"agents":{"type":"integer","format":"int32","minimum":0},"commands":{"type":"integer","format":"int32","minimum":0},"hook_events":{"type":"array","items":{"type":"string"},"description":"Hook event names only."},"mcp_servers":{"type":"array","items":{"$ref":"#/components/schemas/ServerRefView"}},"skills":{"type":"integer","format":"int32","minimum":0}}},"PluginRefView":{"type":"object","required":["name","marketplace","enabled","brings"],"properties":{"brings":{"$ref":"#/components/schemas/PluginBringsView"},"enabled":{"type":"boolean"},"marketplace":{"type":"string"},"name":{"type":"string"},"pinned":{"type":["boolean","null"],"description":"Pinned to a commit or tag. `null` when the agent could not tell."},"rev":{"type":["string","null"],"description":"The pinned commit's first 12 characters, or the tag."},"source":{"type":["string","null"],"description":"Where the plugin was fetched from, as a marketplace source kind."},"source_url":{"type":["string","null"],"description":"The git URL or URL it was fetched from."},"version":{"type":["string","null"]}}},"PolicyActivity":{"type":"object","required":["window","bucket_starts","decisions","blocked","alerted","undetermined","machines","series","engines","tools"],"properties":{"alerted":{"type":"integer","format":"int64"},"blocked":{"type":"integer","format":"int64"},"bucket_starts":{"type":"array","items":{"type":"string"},"description":"Thirty RFC 3339 bucket starts, oldest first."},"decisions":{"type":"integer","format":"int64"},"engines":{"type":"array","items":{"$ref":"#/components/schemas/ActivityEngine"}},"machines":{"type":"integer","format":"int64"},"p95_ms":{"type":["number","null"],"format":"double"},"series":{"type":"array","items":{"$ref":"#/components/schemas/ActivityOutcomeSeries"},"description":"One per outcome present."},"tools":{"type":"array","items":{"$ref":"#/components/schemas/ActivityTool"},"description":"The top three tools."},"undetermined":{"type":"integer","format":"int64"},"window":{"type":"string"}}},"PolicyCapabilitiesView":{"type":"object","description":"Everything this workspace can do with one policy type.","required":["subject","predicates","actions","sources","engines","host_categories","interaction_kinds","inputs"],"properties":{"actions":{"type":"array","items":{"$ref":"#/components/schemas/ActionCapabilityView"}},"categories":{"type":"array","items":{"$ref":"#/components/schemas/ServiceCategoryView"},"description":"The service categories a filter with `takes_categories` may name, written\n`$slug`. Absent on a type with no such filter."},"connector":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ConnectorCapabilityView","description":"The Connector trigger's own catalogue. `null` on every other trigger —\nnot an empty object, because \"this is not about a connector\" and \"this\nworkspace has no connections\" are different answers."}]},"engines":{"type":"array","items":{"$ref":"#/components/schemas/EngineConditionView"},"description":"What each engine can actually be asked about, as the engine declares\nit."},"fix_kinds":{"type":"array","items":{"$ref":"#/components/schemas/FixKindView"},"description":"The kinds of Fix a policy may apply. Host (`file_artifact`) only; absent\non every other trigger."},"hook":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HookTriggerView","description":"The Hook trigger's own block: the eight action kinds, the filters each\noffers and what each may decide. `null` on every other trigger."}]},"host_categories":{"type":"array","items":{"$ref":"#/components/schemas/HostCategoryView"},"description":"The categories a Host policy may pick, for `file_artifact`; empty for\nevery other subject. A policy picks at most one; none means every\ncategory."},"inputs":{"type":"array","items":{"$ref":"#/components/schemas/InputView"},"description":"What may be given to an engine under this trigger — the text a policy\ncan look at, as opposed to the facts in `predicates`. In picker order;\nempty for a subject with no editor."},"interaction_kinds":{"type":"array","items":{"$ref":"#/components/schemas/InteractionKindView"},"description":"The sub-categories a Network policy may pick: today just Attachment,\nfor `prompt`; empty for every other subject. A policy picks at most\none; none means any interaction."},"lock_tools":{"type":"array","items":{"type":"string"},"description":"The AI tools a Lock is held on, as tool ids in a fixed order. A Lock\nthat matches a tool outside this list does not hold on it. Hook and\nHost only; absent elsewhere."},"predicates":{"type":"array","items":{"$ref":"#/components/schemas/PredicateSpecView"},"description":"Every filter field for this type, each with what it is worth in this\nworkspace. Fields this workspace cannot answer yet are listed too."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/SourceCoverageView"}},"subject":{"type":"string","description":"The policy type this document answers for, echoed back from the\nrequest."}}},"PolicyDecisionStat":{"type":"object","required":["policy_id","provided","name","mode","decisions","by_outcome","series"],"properties":{"by_outcome":{"type":"array","items":{"$ref":"#/components/schemas/DecisionOutcomeCount"}},"decisions":{"type":"integer","format":"int64"},"mode":{"type":"string","description":"`draft | monitor | enforce` — the policy's mode for this workspace now."},"name":{"type":"string"},"policy_id":{"type":"string"},"provided":{"type":"boolean","description":"`true` for a policy provided by Oxelone rather than written by the\nworkspace."},"series":{"type":"array","items":{"$ref":"#/components/schemas/DecisionsBucket"},"description":"Aligned with `bucket_starts`."}}},"PolicyHitCountView":{"type":"object","required":["policy_id","total","recent","daily"],"properties":{"daily":{"type":"array","items":{"type":"integer","format":"int64"},"description":"Hits per UTC day, oldest first, today last, zero-filled: always seven\nentries, all zeros for a policy last hit before the window."},"policy_id":{"type":"string"},"recent":{"type":"integer","format":"int64","description":"Hits in the trailing seven UTC days: the sum of `daily`. Not the same\nfigure as `last_30d` on `GET /policies/{id}/hits`, which is a rolling\n30 days."},"total":{"type":"integer","format":"int64","description":"Every hit this policy has ever had."}}},"PolicyHitsView":{"type":"object","required":["total","last_30d"],"properties":{"last_30d":{"type":"integer","format":"int64"},"total":{"type":"integer","format":"int64"}}},"PolicyInput":{"type":"object","description":"The fields of a policy a caller writes: name, subject_kind, condition,\nactions, fail_mode, latency_budget_ms. `id` and `version` are assigned by\nthe server, and a policy's state is changed only through its mode route,\nwhich needs `policies:publish`.","required":["body"],"properties":{"body":{}}},"PolicyLayoutView":{"type":"object","required":["items"],"properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/LayoutItemView"},"description":"The tab's top level, first first: every group on it, and every policy in\nno group."}}},"PolicyRefView":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string"},"name":{"type":"string"}}},"PolicyValidationView":{"type":"object","description":"What the editor learns by asking rather than by guessing.\n\n`ok` answers the question the Save button needs; `arming` answers the one the\nPromote button needs, and they are separate because a draft is allowed to\nfail the second while passing the first.","required":["ok","can_arm","enforcement_barred","warnings"],"properties":{"arming_refusal":{"type":["string","null"],"description":"Why this body could not be enabled, or `null` if it could. Show it as\nit is: where an engine's accuracy is the reason, it names the measured\nfalse-positive rate and the backend to choose instead."},"can_arm":{"type":"boolean","description":"Whether this body could be **armed** — moved out of draft — as things\nstand in this workspace right now."},"enforcement_barred":{"type":"boolean","description":"Whether the refusal is about enforcing — an engine not accurate enough\nto block or redact on — rather than something an unfinished policy has\nnot got round to yet. `can_arm: false` alone does not say which. False\nwhenever there is no refusal."},"limitations":{"type":"array","items":{"$ref":"#/components/schemas/LimitationView"},"description":"What this workspace's fleet will not do for this body, even though\nnothing refuses it — for example, a category no live machine scans for.\n\nNever a refusal: it does not change `ok` or `can_arm`. Absent when\nempty."},"ok":{"type":"boolean","description":"Whether this body can be **saved** as a draft. False only for something\nstorage itself cannot hold — a body that does not match the model, or a\npattern that does not compile."},"refusal":{"type":["string","null"],"description":"Why not, in the server's own words, or `null`."},"warnings":{"type":"array","items":{"$ref":"#/components/schemas/PolicyWarningView"},"description":"What publishing will warn about in this body, never a refusal:\n`scope_names_missing_profile` for a profile deleted since it was named,\n`targets_hook_actions` for a Network policy written against `hook://` or\n`HOOK`. Empty when the body did not parse."}}},"PolicyWarningView":{"type":"object","description":"One warning publishing would raise about a policy body, as validation\nreturns it. Never a refusal.","required":["code","message"],"properties":{"code":{"type":"string","description":"`scope_names_missing_profile` or `targets_hook_actions`."},"message":{"type":"string","description":"A sentence for the policy's author, meant to be shown as it is."}}},"PolicyWriteView":{"type":"object","description":"A policy mutation's answer: the policy as stored, and what shipping it\ncaused. `publish` is `null` exactly when nothing recompiled — an edit to a\nDisabled policy, which the bundle does not carry.","required":["policy"],"properties":{"policy":{},"publish":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/CompileResponse"}]}}},"PostCommentRequest":{"type":"object","required":["subject_kind","subject_id","body"],"properties":{"body":{"type":"string"},"parent_id":{"type":["string","null"],"description":"The comment this replies to. Must itself be top-level, and must be on\nthe same subject."},"subject_id":{"type":"string"},"subject_kind":{"type":"string"}}},"PostureCheckView":{"type":"object","required":["id","key","source","risk","name","state","open","checked_on","of","subjects_in","subjects_not_in"],"properties":{"checked_on":{"type":"integer","format":"int64","description":"Connections it ran on, out of `of` live ones (0/0 on machine checks)."},"id":{"type":"string","description":"The policy id of the provided connector check or machine check."},"key":{"type":"string","description":"The pack key (`openai/hosted_mcp_enabled`), or the machine check's key\n(`approval_bypass`, `sc_known_bad`)."},"machines":{"type":["integer","null"],"format":"int64","description":"Distinct machines; machine checks only."},"meaning":{"type":["string","null"]},"name":{"type":"string"},"of":{"type":"integer","format":"int64"},"open":{"type":"integer","format":"int64","description":"Open issues (records or tools failing)."},"pack":{"type":["string","null"],"description":"`posture` | `inspection`; absent on a machine check."},"reason":{"type":["string","null"],"description":"Why it is not checked: `not_connected` | `never_synced` | `switched_off`\n| `mode_off` | `opt_in_off` | `unreadable` | `mixed` | `no_tool_settings`\n| `no_artifacts` | `check_off` (a provided machine check this workspace switched off or\nremoved)."},"risk":{"type":"string","description":"A `PostureRiskView` id."},"severity":{"type":["string","null"],"description":"The shipped severity; absent on the supply-chain check."},"source":{"type":"string","description":"A connector id, or `machines`."},"state":{"type":"string","description":"`failing` | `passing` | `not_checked`."},"subjects_in":{"type":"array","items":{"type":"string"},"description":"When this check counts only some of its rule's issues: the subjects it\ncounts (`subjects_in`) or leaves out (`subjects_not_in`), as used in the\nIssues filter. For example, a check about grants to AI apps lists those\napps here, and its counterpart lists them under `subjects_not_in`. Both\nare empty for every other check."},"subjects_not_in":{"type":"array","items":{"type":"string"}},"worst":{"type":["string","null"],"description":"The worst open severity, when `open > 0`."}}},"PostureResponse":{"type":"object","required":["risks","sources","checks","withheld"],"properties":{"checks":{"type":"array","items":{"$ref":"#/components/schemas/PostureCheckView"},"description":"Every check of every visible source."},"risks":{"type":"array","items":{"$ref":"#/components/schemas/PostureRiskView"},"description":"All six risks, in the matrix's order."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/PostureSourceView"},"description":"One per connector that ships posture checks, then `machines`; a source\nlisted in `withheld` is absent."},"withheld":{"type":"array","items":{"type":"string"},"description":"Sources this caller may not read: `connections` and/or `machines`."}}},"PostureRiskView":{"type":"object","required":["id","label","line","ai"],"properties":{"ai":{"type":"boolean","description":"False only for `foundations`."},"id":{"type":"string","description":"`data_exposure` | `web_and_tools` | `autonomous_agents` | `supply_chain` | `idle_ai` | `foundations`."},"label":{"type":"string"},"line":{"type":"string","description":"One line naming what the shipped checks under it read."}}},"PostureSourceView":{"type":"object","required":["id","label","connections"],"properties":{"connections":{"type":"integer","format":"int64","description":"Live connections of this connector (0: not connected); for `machines`,\nthe machines that have reported AI tool settings."},"id":{"type":"string","description":"A connector id, or `machines`."},"label":{"type":"string"}}},"PredicateSpecView":{"type":"object","description":"One filter field an author may pick, and what it is worth in this workspace.\n\nEvery field is listed, including those this workspace's machines cannot\nanswer yet; the coverage counts say how many can.","required":["kind","category","label","tier","locus","value","operators","covered_machines","uncovered_machines"],"properties":{"applies_to":{"type":"array","items":{"type":"string"},"description":"The Host categories this field is a fact about. Empty (and absent)\nmeans every category.\n\nA file's name, location and type are known whatever the file is; its\ntext, its library name and its registry tag are not."},"category":{"type":"string","description":"The group this field is listed under: `destination` | `application` |\n`identity` | `content` | `finding` | `context`."},"covered_machines":{"type":"integer","format":"int64","description":"Machines in this workspace on which this predicate can be evaluated."},"enforcement_refusal":{"type":["string","null"],"description":"Why an enforcing response conditioned on this entry's engine would be\nrefused, or `null` if it would not. A lower-case fragment, meant to\nfollow a lead-in; it names the measured false-positive rate and the\nbackend to choose instead."},"engine":{"type":["string","null"],"description":"The engine this entry is bound to, for the two engine-backed kinds;\nthere is one entry per engine."},"kind":{"type":"string","description":"The filter's `kind`, exactly as a policy body writes it:\n`service_is`, `body_contains`, `engine_label`, and so on."},"label":{"type":"string","description":"The field's display name, and only the name."},"locus":{"type":"string","description":"`agent` | `server` — where a filter over this field is answered: on the\nmachine, or by Oxelone. One server-side filter moves the whole policy to\nthe server."},"operators":{"type":"array","items":{"$ref":"#/components/schemas/OperatorView"},"description":"The comparisons that can be evaluated over this field, in the order to\noffer them. Any other comparison is refused."},"options":{"type":"array","items":{"$ref":"#/components/schemas/EnumOptionView"},"description":"The members of the closed list `value.options` names, when anything can\nsupply them. Empty (and absent) is a real answer, not a failure: a\nworkspace that has never seen an AI tool has no tool list."},"suggestions":{"type":"array","items":{"$ref":"#/components/schemas/EnumOptionView"},"description":"Values this workspace has actually been seen using, for a field whose\nvalue is not a closed list. Suggestions only: an OS user or host nobody\nhas been seen on yet is still a valid value."},"takes_categories":{"type":"boolean","description":"Whether a value of this field may be a service category, written\n`$slug`: service and host on a Network policy."},"tier":{"type":"string","description":"`inline` | `engine` | `observation`: whether the field is read directly,\nanswered by an engine, or taken from what the fleet observed."},"uncovered_machines":{"type":"integer","format":"int64","description":"Machines on which it cannot, because their capture tactic gives the\nevaluator no body to look at.\n\nNon-zero only for the three body predicates. **An engine predicate is\nreported as covered everywhere**, which is deliberately conservative: an\nengine's own input requirements are not modelled anywhere in this\ncodebase, so claiming one cannot fire would be inventing a fact to fill a\nfield."},"value":{"$ref":"#/components/schemas/ValueShapeView"}}},"PresenceActionInput":{"type":"object","required":["action"],"properties":{"action":{"type":"string","description":"The descriptor's action id, e.g. `remove_member`. The record it acts on\nis the presence's own — a caller does not name one, and cannot name\nanother person's."}}},"PresenceActionView":{"type":"object","description":"One action the connector offers for this presence's kind of record.\nWhen `available` is false, running it is refused and `unavailable_reason`\nsays why.","required":["id","label","consequence","reversible","available"],"properties":{"available":{"type":"boolean"},"consequence":{"type":"string","description":"One sentence, shown in the confirmation. The vendor's words, verbatim."},"id":{"type":"string"},"label":{"type":"string","description":"The connector's own label, e.g. *Remove from organisation*."},"reversible":{"type":"boolean"},"unavailable_reason":{"type":["string","null"],"description":"Why not, when `available` is false. The probe's own sentence where\nthere is one."}}},"PresenceView":{"type":"object","description":"One sighting of one person, whole.","required":["id","source","enterprise_verdict","corporate_address","status","facts","first_seen_at","last_seen_at","actions"],"properties":{"actions":{"type":"array","items":{"$ref":"#/components/schemas/PresenceActionView"},"description":"The connector actions that apply to this kind of presence, and nothing\nelse: a repository action never appears on a person."},"address":{"type":["string","null"]},"artifact_id":{"type":["string","null"]},"connection_id":{"type":["string","null"]},"connection_name":{"type":["string","null"],"description":"The name somebody in the workspace gave the connection."},"connector":{"type":["string","null"]},"corporate_address":{"type":"boolean"},"enterprise_evidence":{"type":["string","null"],"description":"The sentence naming what said so. Never a guess: `null` where nothing\ndid."},"enterprise_verdict":{"type":"string","description":"`enterprise`, `personal` or `unknown`."},"external_id":{"type":["string","null"]},"facts":{"type":"object","description":"The metadata the source carried, as keys and values the source chose.\nMetadata only: never a prompt, a response or a body.","additionalProperties":{},"propertyNames":{"type":"string"}},"first_seen_at":{"type":"string"},"id":{"type":"string"},"kind_label":{"type":["string","null"],"description":"The connector's word for that kind, e.g. *Members*."},"last_seen_at":{"type":"string"},"machine_hostname":{"type":["string","null"]},"machine_id":{"type":["string","null"]},"os_user":{"type":["string","null"]},"program":{"type":["string","null"],"description":"The tool, for a `tool` presence — `claude_code`, `cursor`."},"record_kind":{"type":["string","null"]},"role":{"type":["string","null"]},"source":{"type":"string","description":"`tool`, `connector` or `endpoint`."},"status":{"type":"string","description":"`active`, `suspended`, `invited` or `disappeared`."}}},"PreviewByTool":{"type":"object","required":["tool","n"],"properties":{"n":{"type":"integer","format":"int64"},"tool":{"type":"string"}}},"PreviewSample":{"type":"object","required":["machine_id","hostname","tool"],"properties":{"evidence":{"type":["string","null"],"description":"The first item the filter matched (a rule, an MCP server, a plugin), when it matched\none."},"hostname":{"type":"string"},"machine_id":{"type":"string"},"tool":{"type":"string"}}},"PutAiToolSettingsRequest":{"type":"object","description":"The same shape `GET` returns, so the editor posts back the object it was\ngiven rather than a second type that has to be kept assignable to the first.","required":["corporate_domains"],"properties":{"corporate_domains":{"type":"array","items":{"type":"string"}}}},"PutTagsRequest":{"type":"object","required":["tags"],"properties":{"tags":{"type":"array","items":{"type":"string"}}}},"RecordFieldSpecView":{"type":"object","required":["id","label","shape","values","operators","closed"],"properties":{"closed":{"type":"boolean","description":"Whether `values` (or `list_source`) is the *only* permitted set — true\nfor `enum`, false otherwise."},"id":{"type":"string","description":"The descriptor's own `RecordField.id` — the value a `record` row\ncarries on `path`."},"label":{"type":"string","description":"The field's display name, such as *Visibility*."},"list_source":{"type":["string","null"],"description":"Which list supplies the values of an `identifier` field whose `values`\nis empty; `null` when `values` already holds the list (an `enum`)."},"operators":{"type":"array","items":{"type":"string"},"description":"The comparisons this shape offers; saving checks against the same list."},"shape":{"type":"string","description":"`text` | `identifier` | `enum` | `number` | `boolean`."},"values":{"type":"array","items":{"type":"string"},"description":"The values an `enum` allows, in the order the picker lists them."}}},"RecordKindCapabilityView":{"type":"object","description":"One record kind, as **this** connection offers it.","required":["connector","id","label","mode","events","fields","inputs","readable"],"properties":{"connector":{"type":"string","description":"**Which connector declares it**, because `id` alone is not unique\nacross them: two connectors both have a `member`, and the platform\ndocument lists every live connector at once when none is named. Task\n8's `validate` picks the descriptor from this rather than guessing."},"events":{"type":"array","items":{"type":"string"},"description":"`state` | `appeared` | `changed` | `disappeared` | `audit`, in the order\nthe *When* checklist lists them. Derived from the record's cadence, so a\nkind cannot offer an event with no diff behind it."},"fields":{"type":"array","items":{"$ref":"#/components/schemas/RecordFieldSpecView"}},"id":{"type":"string"},"inputs":{"type":"array","items":{"$ref":"#/components/schemas/ConnectorInputView"}},"label":{"type":"string"},"mode":{"type":"string"},"readable":{"type":"boolean","description":"Whether this connection can read this record kind. A rule over a kind\nit cannot read is hidden and refused on save; the kind is still listed,\nwith `unreadable_reason` saying why."},"unreadable_reason":{"type":["string","null"]}}},"RestrictionValueView":{"type":"string","enum":["allow","block"]},"RolloutTargetView":{"type":"object","description":"One OS's share of a rollout: the version its machines are moving to and\nhow they are doing.","required":["os","version","machines","counts"],"properties":{"counts":{"type":"object","description":"Those machines per state, zeros left out.","additionalProperties":{"type":"integer","format":"int64"},"propertyNames":{"type":"string"}},"machines":{"type":"integer","format":"int64","description":"The rollout's machines of this OS moving to `version`."},"os":{"type":"string","description":"`windows` | `macos` | `linux`."},"version":{"type":"string"}}},"RolloutView":{"type":"object","description":"A rollout: one start action and the machines it covers.","required":["id","scope","target_version","targets","max_retries","started_at","counts","rows"],"properties":{"cancelled_at":{"type":["string","null"]},"counts":{"type":"object","description":"Rows per state, zeros left out.","additionalProperties":{"type":"integer","format":"int64"},"propertyNames":{"type":"string"}},"finished_at":{"type":["string","null"],"description":"Set once no machine has anything left to do."},"id":{"type":"string"},"max_retries":{"type":"integer","format":"int32","description":"Automatic retries per machine, 0–5."},"profile_id":{"type":["string","null"]},"rows":{"type":"array","items":{"$ref":"#/components/schemas/MachineUpdateView"}},"scope":{"type":"string","description":"`profile` | `machine`."},"started_at":{"type":"string"},"started_by":{"type":["string","null"],"description":"The user who started it; `null` when the sweep started it because the\nprofile updates automatically (or the user has since been deleted —\nthe audit row still names them)."},"target_version":{"type":"string","description":"The highest version any of its machines is moving to — a headline.\nMachines of different OSes can move to different versions: `targets`\nsays which, and each row carries its own `target_version`."},"targets":{"type":"array","items":{"$ref":"#/components/schemas/RolloutTargetView"},"description":"Per OS, in the order `windows`, `macos`, `linux`."}}},"RouteView":{"type":"object","required":["through","why"],"properties":{"through":{"type":"string","description":"`native` or `companion`."},"why":{"type":"string"}}},"RuleAdditionView":{"type":"object","required":["key","project","rule","first_seen_at"],"properties":{"first_seen_at":{"type":"string"},"key":{"type":"string","description":"`auto_approved`, `asked` or `denied`."},"project":{"type":"string"},"rule":{"type":"string"},"session_id":{"type":["string","null"],"description":"The session it is attributed to, or `null`: *Saved outside a known session*."}}},"RuleItemView":{"type":"object","description":"One rule, after the agent's redaction, and why it is over-permissive.","required":["text"],"properties":{"risk":{"type":["string","null"],"description":"`any_shell` | `any_fetch` | `any_mcp_server` | `any_edit` | `outside_project`; `null`\nwhen the rule is not over-permissive."},"text":{"type":"string"}}},"SavedRuleView":{"type":"object","required":["key","rule"],"properties":{"key":{"type":"string"},"risk":{"type":["string","null"]},"rule":{"type":"string"}}},"ScanConfigView":{"type":"object","description":"The scan configuration a machine should be running.","required":["enabled","smart_minutes","full_hours","max_depth","max_files","roots","skips","categories"],"properties":{"categories":{"type":"array","items":{"type":"string"},"description":"Empty means every artifact category."},"enabled":{"type":"boolean"},"full_hours":{"type":"integer","format":"int32","minimum":0},"max_depth":{"type":"integer","format":"int32","minimum":0},"max_files":{"type":"integer","format":"int32","minimum":0},"roots":{"type":"array","items":{"type":"string"},"description":"Empty means the agent's per-OS defaults, never \"nowhere\". Scanning\nnothing is `enabled: false`."},"skips":{"type":"array","items":{"type":"string"}},"smart_minutes":{"type":"integer","format":"int32","minimum":0}}},"ScanRunListResponse":{"type":"object","required":["scans","total"],"properties":{"next_cursor":{"type":["string","null"]},"scans":{"type":"array","items":{"$ref":"#/components/schemas/ScanRunView"}},"total":{"type":"integer","format":"int64"}}},"ScanRunView":{"type":"object","required":["id","machine_id","kind","outcome","roots_scanned","files_seen","artifacts_reported","discovered","content_changed","disappeared","returned","out_of_scope","unchanged","rejected","changed_something","created_at"],"properties":{"artifacts_reported":{"type":"integer","format":"int32"},"changed_something":{"type":"boolean","description":"Whether this run changed the inventory. A run that did is always kept;\nof the runs that did not, only each machine's most recent few are."},"content_changed":{"type":"integer","format":"int32"},"created_at":{"type":"string"},"disappeared":{"type":"integer","format":"int32"},"discovered":{"type":"integer","format":"int32"},"duration_ms":{"type":["integer","null"],"format":"int64","description":"Elapsed milliseconds between `started_at` and `finished_at`."},"failure_reason":{"type":["string","null"]},"files_seen":{"type":"integer","format":"int64"},"finished_at":{"type":["string","null"]},"id":{"type":"string"},"kind":{"type":"string"},"machine_id":{"type":"string"},"out_of_scope":{"type":"integer","format":"int32"},"outcome":{"type":"string","description":"`open`, `completed`, `partial` or `failed`. A run still `open` long\nafter it started is a scan that never finished, which is itself a\nproblem worth looking into."},"rejected":{"type":"integer","format":"int32"},"returned":{"type":"integer","format":"int32"},"roots_scanned":{"type":"integer","format":"int32"},"scope_version":{"type":["string","null"]},"started_at":{"type":["string","null"]},"unchanged":{"type":"integer","format":"int32"}}},"ScoreView":{"type":"object","description":"A number an engine emits, with the bounds that make a control renderable.","required":["min","max","default_threshold","higher_is_worse","display","description","bands"],"properties":{"bands":{"type":"array","items":{"$ref":"#/components/schemas/BandView"},"description":"The named levels this number has, ascending, or empty where the engine\ndeclares none — a plain count has no levels. Always present."},"default_threshold":{"type":"number","format":"double","description":"The engine's own recommended threshold, a calibrated starting point for\na new condition."},"description":{"type":"string","description":"A longer explanation of the number — how it is aggregated and\ncalibrated. Empty when the name says it all."},"display":{"type":"string","description":"A short name for what the number counts."},"higher_is_worse":{"type":"boolean","description":"Whether a higher number means *more* of the thing the engine detects.\nThe only predicate available is *score at least*, so an editor rendering\na `false` here has to negate the condition rather than word it directly."},"max":{"type":"number","format":"double"},"min":{"type":"number","format":"double"}}},"SendCommandRequest":{"type":"object","required":["kind"],"properties":{"kind":{"type":"string"},"payload":{}}},"SendCommandResponse":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}},"ServerRefView":{"type":"object","required":["name","transport"],"properties":{"args":{"type":"array","items":{"type":"string"},"description":"The arguments, key-shaped values `[redacted]` by the agent."},"host_or_launcher":{"type":["string","null"]},"inline_secret":{"type":"boolean","description":"An argument or the URL carries what looks like a key."},"insecure":{"type":"boolean","description":"Reached over plain http at a host that is not the machine."},"name":{"type":"string"},"package":{"type":["string","null"],"description":"The package or image name."},"pinned":{"type":["boolean","null"],"description":"The package or image names a fixed version. `null`: nothing to pin, or an older agent."},"transport":{"type":"string","description":"`stdio` | `http` | `sse`."},"url":{"type":["string","null"],"description":"A remote server's URL, without userinfo, query or fragment."},"version":{"type":["string","null"],"description":"The version as written: `latest`, `1.2.3`."}}},"ServiceCategoryMemberView":{"type":"object","description":"One service a category covers.","required":["service_id","display_name","patterns","origin"],"properties":{"display_name":{"type":"string","description":"The catalog row's own name."},"observed":{"type":["boolean","null"],"description":"Whether this workspace has ever been seen using it. Absent on the\nplatform's own document, where there is no workspace to have seen it."},"origin":{"type":"string","description":"`vendor` (Oxelone put it there) or `workspace` (this workspace did, and\nmay take it out)."},"patterns":{"type":"array","items":{"type":"string"},"description":"Chrome match patterns, as the catalog stores them."},"service_id":{"type":"string"}}},"ServiceCategoryView":{"type":"object","description":"One service category.","required":["slug","display_name","description","origin","members"],"properties":{"description":{"type":"string","description":"One line on what it covers."},"display_name":{"type":"string","description":"A name, never a sentence: *Criminal AI*."},"members":{"type":"array","items":{"$ref":"#/components/schemas/ServiceCategoryMemberView"}},"origin":{"type":"string","description":"`vendor` (Oxelone's: additions only) or `workspace` (this workspace's\nown: renamed, described and deleted here)."},"policies":{"type":["integer","null"],"format":"int64","description":"How many of this workspace's Network policies name it. Only the\nCoverage Matrix's list carries it."},"slug":{"type":"string","description":"What a policy stores: `$criminal-ai`."}}},"ServiceHitsView":{"type":"object","required":["service","hits"],"properties":{"hits":{"type":"integer","format":"int64"},"service":{"type":"string"}}},"ServiceUsageView":{"type":"object","description":"One observed service in the window.\n\nA row with `catalogued: false` is a host no enabled catalog entry covers:\nShadow AI, counted by the same rule as the overview's Shadow AI total.","required":["service","observations","machines","request_bytes","response_bytes","first_seen_at","last_seen_at","catalogued","catalog_service_id","people"],"properties":{"catalog_service_id":{"type":["string","null"],"description":"That row's `service_id` — `service` itself, or the row whose pattern\ncovers the host. `null` when uncatalogued."},"catalogued":{"type":"boolean","description":"Whether an enabled catalog row covers `service`."},"first_seen_at":{"type":"string","description":"The earliest observation in the window."},"last_seen_at":{"type":"string"},"machines":{"type":"integer","format":"int64"},"observations":{"type":"integer","format":"int64"},"people":{"type":"integer","format":"int64","description":"Distinct people in the window: a person counts when one of their\npresences matches an interaction's account address or its machine's\nOS account."},"request_bytes":{"type":"integer","format":"int64"},"response_bytes":{"type":"integer","format":"int64"},"service":{"type":"string","description":"`observations.service` as stored: the catalog `service_id` where a\npattern covered the host at ingest, otherwise the agent's own string,\nusually a host."}}},"SessionInteractionsView":{"type":"object","required":["count","blocked"],"properties":{"blocked":{"type":"integer","format":"int64"},"count":{"type":"integer","format":"int64"}}},"SessionLockView":{"type":"object","description":"One live session lock, and the decision that locked it.","required":["id","scope","tool","machine_id","state","locked_at","policy_id","policy_version","matched","message","refused","minted_by"],"properties":{"decision_id":{"type":["string","null"],"description":"The decision that locked it: for a Session-log lock (`minted_by: server`)\nthe decision's ID in Runs; for a Hook lock (`minted_by: agent`) the hook\ncall's correlation ID, whose interaction is `observation_id`. `null` when\nnone was recorded."},"id":{"type":"string"},"lifts_at":{"type":["string","null"],"description":"`null` is *until someone unlocks it*."},"locked_at":{"type":"string"},"machine_id":{"type":"string"},"matched":{"type":"string","description":"What matched, in a few words."},"message":{"type":"string","description":"The words the person sees on every refused call."},"minted_by":{"type":"string","description":"`agent` (a Hook policy) or `server` (a Session-log policy)."},"observation_id":{"type":["string","null"],"description":"For a Hook lock, the interaction (hook observation) that locked it — the icon's link.\n`null` for a Session-log lock, and until the hook observation arrives."},"policy_id":{"type":"string"},"policy_name":{"type":["string","null"],"description":"The policy's current name; `null` when it no longer exists."},"policy_version":{"type":"integer","format":"int32"},"refused":{"type":"integer","format":"int32","description":"Calls refused under this lock, as the machine last reported."},"scope":{"type":"string","description":"`session` or `tool`."},"session_id":{"type":["string","null"],"description":"`null` on a tool-wide lock."},"state":{"type":"string","description":"`held`, or `unlock_pending` once somebody pressed Unlock and the machine has not yet\nchecked in."},"tool":{"type":"string","description":"The registry slug."}}},"SetGroupOrderRequest":{"type":"object","description":"A new order for one tab's groups.","required":["subject","ids"],"properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Every group of that type this workspace has (removed provided ones\nexcepted), in the order they should appear."},"subject":{"type":"string","description":"`prompt`, `file_artifact` or `hook`."}}},"SetGroupOrderResponse":{"type":"object","required":["reordered"],"properties":{"reordered":{"type":"integer","format":"int64","description":"How many groups moved: the number of `ids` sent, on success.","minimum":0}}},"SetGroupStateRequest":{"type":"object","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"`true` is On, `false` is Off."}}},"SetLayoutRequest":{"type":"object","required":["subject","items"],"properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/LayoutItemView"},"description":"Every item `GET` answers for this tab, in the new order. A replacement:\nan item left out is a stale list (409), not a removal."},"subject":{"type":"string","description":"The tab, as `GET`'s `subject`."}}},"SetModeRequest":{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","description":"One of `draft`, `monitor`, `enforce`."}}},"SetModesRequest":{"type":"object","description":"One state for many policies, at most 500 ids.","required":["ids","mode"],"properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Policy ids, the workspace's own and provided ones alike."},"mode":{"type":"string","description":"One of `draft`, `monitor`, `enforce`."}}},"SetModesResponse":{"type":"object","required":["results","kept_enabled"],"properties":{"kept_enabled":{"type":"integer","format":"int64","description":"*Monitor where it applies*: how many of the ids asked for Monitor are\nEnabled instead (changed to it, or already in it), because nothing in them\nchanges anything. `0` for any other mode.","minimum":0},"publish":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/CompileResponse","description":"The one publish the change caused, or `null` when nothing changed."}]},"results":{"type":"array","items":{"$ref":"#/components/schemas/ModeResultView"},"description":"One entry per id sent, in the order sent."}}},"SetOrderRequest":{"type":"object","description":"A new order for one policy type's list.","required":["subject","ids"],"properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Every policy of that type in this workspace, in the order they should\nappear."},"subject":{"type":"string","description":"The policy type this order is within — one of `prompt`, `file_artifact`,\n`asset`, `connector_event`, `egress`.\n\nRequired rather than inferred from the ids, and that is the point of the\nfield: precedence is only meaningful *within* a type, because ordering a\nprompt policy against a file-artifact one answers no question anybody\nasks. Naming it lets the route refuse a list that mixes two, which is a\ncaller bug that would otherwise be stored and rendered as an order."}}},"SetOrderResponse":{"type":"object","required":["reordered"],"properties":{"reordered":{"type":"integer","format":"int64","description":"How many policies moved: the number of `ids` sent, on success. A partial\nlist is refused, never applied in part.","minimum":0}}},"SetStrategyEnabledRequest":{"type":"object","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Whether this strategy should be running."}}},"SettingChangeView":{"type":"object","description":"One change on a *Settings changed* event: a key, its scope, and words or counts.","required":["key","scope"],"properties":{"from":{"type":["string","null"],"description":"`null` for a key that appeared."},"key":{"type":"string"},"scope":{"type":"string"},"to":{"type":["string","null"],"description":"`null` for a key that went."}}},"SettingIssueView":{"type":"object","required":["id","rule","severity"],"properties":{"id":{"type":"string"},"rule":{"type":"string","description":"The provided check's key: `approval_bypass`, `shell_auto_approved`, …"},"severity":{"type":"string"}}},"SettingSourceView":{"type":"object","required":["id","scope","location","format","state"],"properties":{"format":{"type":"string"},"id":{"type":"integer","format":"int32","minimum":0},"in_repository":{"type":["boolean","null"],"description":"A project folder inside a git work tree. `null` when the agent did not look (an older\nagent)."},"location":{"type":"string"},"project":{"type":["string","null"]},"reason":{"type":["string","null"],"description":"On `unreadable`: `busy` | `denied` | `malformed` | `link`."},"scope":{"type":"string","description":"`managed` | `user` | `project` | `default`."},"state":{"type":"string","description":"`read` | `unreadable` | `too_large`."}}},"SettingValueView":{"oneOf":[{"type":"object","required":["value","raw","shape"],"properties":{"raw":{"type":"string"},"shape":{"type":"string","enum":["mode"]},"value":{"type":"string"}}},{"type":"object","required":["value","shape"],"properties":{"shape":{"type":"string","enum":["bool"]},"value":{"type":"boolean"}}},{"type":"object","required":["n","shape"],"properties":{"items":{"type":"array","items":{"type":"string"}},"more":{"type":"integer","format":"int32","minimum":0},"n":{"type":"integer","format":"int32","minimum":0},"shape":{"type":"string","enum":["count"]}}},{"type":"object","required":["n","shape"],"properties":{"any_fetch":{"type":"boolean"},"any_mcp":{"type":"boolean"},"any_shell":{"type":"boolean"},"items":{"type":"array","items":{"$ref":"#/components/schemas/RuleItemView"},"description":"Each rule with its risk."},"more":{"type":"integer","format":"int32","minimum":0},"n":{"type":"integer","format":"int32","minimum":0},"shape":{"type":"string","enum":["rules"]}}},{"type":"object","required":["n","shape"],"properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ServerRefView"}},"more":{"type":"integer","format":"int32","minimum":0},"n":{"type":"integer","format":"int32","minimum":0},"shape":{"type":"string","enum":["servers"]}}},{"type":"object","required":["host","shape"],"properties":{"host":{"type":"string"},"shape":{"type":"string","enum":["host"]}}},{"type":"object","required":["shape"],"properties":{"keys":{"type":"array","items":{"$ref":"#/components/schemas/StoredKeyView"},"description":"Each name with the kind of key the agent recognised on the machine. Never a value."},"more":{"type":"integer","format":"int32","minimum":0},"names":{"type":"array","items":{"type":"string"}},"shape":{"type":"string","enum":["stored"]}}},{"type":"object","description":"Extra directories.","required":["n","shape"],"properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DirectoryRefView"}},"more":{"type":"integer","format":"int32","minimum":0},"n":{"type":"integer","format":"int32","minimum":0},"shape":{"type":"string","enum":["directories"]}}},{"type":"object","description":"Installed plugins.","required":["n","shape"],"properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginRefView"}},"more":{"type":"integer","format":"int32","minimum":0},"n":{"type":"integer","format":"int32","minimum":0},"shape":{"type":"string","enum":["plugins"]}}},{"type":"object","description":"Plugin marketplaces.","required":["n","shape"],"properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/MarketplaceRefView"}},"more":{"type":"integer","format":"int32","minimum":0},"n":{"type":"integer","format":"int32","minimum":0},"shape":{"type":"string","enum":["marketplaces"]}}}],"description":"A setting's value. Never a secret: a key is the names of what is stored."},"SettingView":{"type":"object","required":["key","raw_key","source","value","effective"],"properties":{"effective":{"type":"boolean"},"issue":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SettingIssueView","description":"The open issue this row backs, so the inspector tones the value without a second fetch."}]},"key":{"type":"string","description":"One of the closed key set (`approval_mode`, `auto_approved`, …)."},"raw_key":{"type":"string","description":"The vendor's own key, from the agent's constants."},"source":{"type":"integer","format":"int32","minimum":0},"value":{"$ref":"#/components/schemas/SettingValueView"}}},"SettingsChangeView":{"type":"object","required":["changes","more"],"properties":{"changes":{"type":"array","items":{"$ref":"#/components/schemas/SettingChangeView"}},"more":{"type":"integer","format":"int32","minimum":0}}},"SettingsFlagView":{"type":"object","description":"The worst open setting issue of an install: what its list row's end says.","required":["rule","severity"],"properties":{"rule":{"type":"string","description":"The provided check's key: `approval_bypass`, `shell_auto_approved`, …"},"severity":{"type":"string"}}},"SimulateInput":{"type":"object","description":"The facts of a simulated call; each is read only by the kinds that carry it.","properties":{"command":{"type":["string","null"]},"cwd":{"type":["string","null"],"description":"The working directory, as the agent normalises it (`~/src/app`)."},"mcp_server":{"type":["string","null"]},"mcp_tool":{"type":["string","null"]},"model":{"type":["string","null"]},"path":{"type":["string","null"]},"prompt":{"type":["string","null"]},"tool_input":{"type":["string","null"]},"tool_name":{"type":["string","null"]},"url":{"type":["string","null"]},"write_kind":{"type":["string","null"],"description":"`create`, `edit` or `delete`."}}},"SimulateRequest":{"type":"object","description":"One hypothetical call.","required":["trigger","tool"],"properties":{"action":{"type":["string","null"],"description":"The action kind (`shell`, `file_read`, …). Required for `hook`."},"companion_present":{"type":"boolean","description":"A companion is running in the person's session. Default true."},"content":{"type":"boolean","description":"The machine observes content. `false` simulates a metadata-only machine: every content\nfact reads unknown. Default true."},"draft":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PolicyInput","description":"The editor's unsaved policy, evaluated **in place of its saved version** when its body\nnames one of this workspace's policies by `id`, and added otherwise — as Enabled, whatever\nmode it would be saved in, so the author sees what it would do."}]},"input":{"$ref":"#/components/schemas/SimulateInput","description":"The facts of the call that fit its kind."},"profile_id":{"type":["string","null"],"description":"The enrollment profile to simulate as; `null` is a machine with no profile."},"skip_permissions":{"type":"boolean","description":"The tool is set to skip permissions: the simulated call carries the tool's bypass value,\nwhere it has one."},"tool":{"type":"string","description":"The tool's registry slug (`claude_code`). Required for `hook`; for `prompt` it names the\ntool whose vendor host the request goes to."},"trigger":{"type":"string","description":"`hook` — a tool's hook call (`action` says which) — or `prompt`, a Network prompt as the\nnetwork path sees it. A prompt a hook saw is `trigger: \"hook\", action: \"prompt\"`."}}},"SimulateResponse":{"type":"object","required":["winner","also","policies","network_also"],"properties":{"also":{"type":"array","items":{"$ref":"#/components/schemas/AlsoView"},"description":"The non-enforcing actions of every matched policy: what is raised besides the decision."},"if_no_companion":{"type":["string","null"],"description":"What happens when no companion is running, as a sentence; `null` unless the Ask would go\nto the companion."},"if_unanswered":{"type":["string","null"],"description":"What happens when nobody answers, as a sentence; `null` when nobody would be asked."},"network_also":{"type":"array","items":{"$ref":"#/components/schemas/SimulatedPolicyView"},"description":"For a prompt at a hook: the Network policies checked there, in the same shape."},"policies":{"type":"array","items":{"$ref":"#/components/schemas/SimulatedPolicyView"},"description":"**Every** policy of the trigger — Hook policies of this kind, and for a prompt every\nNetwork policy — matched or not, Disabled, Monitor and out of scope included, each with\nwhy."},"route":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RouteView","description":"Where an Ask would be put, and why; `null` unless the winner is an Ask at a hook."}]},"winner":{"$ref":"#/components/schemas/WinnerView"}}},"SimulatedPolicyView":{"type":"object","required":["id","name","type","order","result","sentence","decision"],"properties":{"decision":{"type":"string","description":"The policy's own decision: `allow`, `ask`, `block` (or `redact` for a Network policy)."},"id":{"type":"string"},"name":{"type":"string"},"order":{"type":"integer","format":"int32","description":"Its place in the list, from 1.","minimum":0},"result":{"type":"string","description":"`matched`, `no_match`, `other_action`, `out_of_scope`, `disabled`, `monitor` or\n`undetermined`."},"sentence":{"type":"string","description":"Why, in one line."},"type":{"type":"string","description":"The policy type's wire word: `hook` or `prompt`."}}},"SourceCoverageView":{"type":"object","description":"How many machines are on one capture tactic, and whether it carries content.","required":["source","machines","carries_content"],"properties":{"carries_content":{"type":"boolean","description":"Whether machines on this tactic capture content. False for `metadata`\nand `none`, where content filters cannot match."},"machines":{"type":"integer","format":"int64"},"source":{"type":"string","description":"A capture tactic: `extension`, `redirect`, `mitm_ca`, `metadata` or\n`none`.\n\nOne machine is on exactly one tactic, so these counts sum to the\nworkspace's live machine count."}}},"SourceMarkView":{"type":"object","description":"One platform a person was seen on — the **Seen on** stack's mark.","required":["source","id"],"properties":{"id":{"type":"string","description":"The program, the connector id, or `endpoint` — what the mark draws."},"source":{"type":"string","description":"`tool`, `connector` or `endpoint`."}}},"StartUpdateRequest":{"type":"object","properties":{"max_retries":{"type":["integer","null"],"format":"int32","description":"Automatic retries per machine, 0–5. Omitted means 3."}}},"SteeringNoteView":{"type":"object","description":"A fact about steering that is **not** a problem: none of these makes the\nmachine Degraded.","required":["kind"],"properties":{"kind":{"type":"string","description":"`yielded` | `stale_incumbent` | `double_tls_inspection`."},"reason":{"type":["string","null"],"description":"The agent's sentence, when it gave one."},"surface":{"type":["string","null"],"description":"The surface, for `yielded` and `stale_incumbent`."}}},"SteeringView":{"type":"object","description":"One machine's own report on its capture tactic.","required":["reported_at","outcome","applied","not_attempted","failures"],"properties":{"applied":{"type":"array","items":{"type":"string"},"description":"The surfaces that went on: `root`, `pac`, `routes`."},"failed_surface":{"type":["string","null"],"description":"The one that did not, or null. This is the field the panel exists for."},"failure":{"type":["string","null"],"description":"Why, in the agent's own words — *\"no TUN driver is available on this\nmachine\"* rather than a code the reader has to look up."},"failures":{"type":"integer","format":"int64","description":"How many plans in a row have failed. `0` on a healthy machine, and the\nnumber that separates *it just broke* from *it has never worked*."},"not_attempted":{"type":"array","items":{"type":"string"},"description":"Surfaces this machine's strategy set never asked for. Not failures, and\nrendering them as such would make a correctly-scoped machine look broken."},"outcome":{"type":"string","description":"`applied`, `failed` or `nothing_to_do`, as the agent reported it."},"reported_at":{"type":"string","description":"When the machine reported this. **Read beside the rest**: a status from\nthree days ago describes a machine that has not planned since, not a\nmachine that is fine."},"resolution":{"type":["string","null"],"description":"One line about what the catalog resolved to, or null. Counts of hosts\nand addresses — never a list of either."},"strategies":{"type":["array","null"],"items":{"type":"string"},"description":"The **enabled** strategies the agent's current plan was made from: what\nit is actually running, where the machine's `enabled_strategies` is\nonly what it was asked to run. `null` when the agent is too old to\nreport it, which is not the same as running nothing."}}},"StoredKeyView":{"type":"object","description":"A stored key's name and the kind of key it is, when the agent's secrets engine recognised it.","required":["name"],"properties":{"kind":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/KeyKindView"}]},"name":{"type":"string"}}},"SubEngineView":{"type":"object","description":"One supply-chain sub-engine: the selector a policy row names, and its\nfields. The four share one output contract, so the field lists are equal\non purpose — carried per selector anyway, because a client that special-\ncased \"they are all the same\" would break the day one grows a path.","required":["id","name","applies_to","fields"],"properties":{"applies_to":{"type":"array","items":{"type":"string"},"description":"The artifact kinds this selector reads. Empty means every kind."},"fields":{"type":"array","items":{"$ref":"#/components/schemas/EngineFieldView"}},"id":{"type":"string","description":"The invocation selector (`package`, `agentic_artifact`, …)."},"name":{"type":"string"}}},"SupplyChainView":{"type":"object","description":"What the supply chain check says about one artifact: the package, the flags\nwith their evidence, the advisories, and the stored resolution.","required":["state","flags","advisories","advisory_severity","licence_class","listed","categories","found_in","name_matches"],"properties":{"advisories":{"type":"array","items":{"$ref":"#/components/schemas/AdvisoryView"},"description":"Advisories that apply, or may; dismissed ones with their dismissal."},"advisory_severity":{"type":"string","description":"`critical|high|medium|low|none`, over applying, non-dismissed advisories."},"cached_until":{"type":["string","null"],"description":"RFC 3339: when the first of these answers will be asked again. The\ncheck's own `output.cached_until` when it wrote one, else the earliest\n`expires_at` across `found_in`."},"catalogued":{"type":["string","null"],"description":"`entry` | `not_catalogued` | `nothing_to_look_up`; `null` while\nchecking or not applicable."},"categories":{"type":"array","items":{"type":"string"},"description":"The `$slug` service categories of the entry."},"checked_at":{"type":["string","null"],"description":"RFC 3339."},"flags":{"type":"array","items":{"$ref":"#/components/schemas/FlagView"},"description":"Raised flags, and dismissed ones with their dismissal."},"found_in":{"type":"array","items":{"$ref":"#/components/schemas/FeedAnswerView"},"description":"One entry per feed that answered about this artifact's key."},"kind":{"type":["string","null"],"description":"The *Catalogued as* value for an entry: `npm_package`, `model`, …"},"licence_class":{"type":"string","description":"`permissive|copyleft|use_restricted|none|unknown`."},"listed":{"type":"boolean"},"name_matches":{"type":"array","items":{"$ref":"#/components/schemas/NameMatchView"},"description":"Marketplace hits on the name alone. These are not a catalogue match and\ncatalogue nothing."},"package":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PackageCardView"}]},"run_id":{"type":["string","null"],"format":"uuid"},"state":{"type":"string","description":"`checking` (the check has not answered yet — never shown as clean),\n`checked`, or `not_applicable`."},"trigger":{"type":["string","null"],"description":"`discovery` | `content_change` | `registry_update`."}}},"SurfaceView":{"type":"object","description":"The state of one steering surface on a machine, as last reported.","required":["surface","state","observed_at"],"properties":{"observed_at":{"type":"string","description":"RFC 3339, this server's clock: when the surface entered this state. An\n`applied_unwitnessed` surface keeps the instant it was applied."},"reason":{"type":["string","null"],"description":"The agent's sentence, when it gave one."},"state":{"type":"string","description":"`applied` | `witnessed` | `flowing` | `applied_unwitnessed` | `yielded` |\n`stale_incumbent` | `root_removed`."},"surface":{"type":"string","description":"`root` | `pac` | `routes`. `root` is the CA surface."}}},"SurveyFindingView":{"type":"object","description":"One thing the agent found already intercepting the machine (B6).","required":["layer","detail"],"properties":{"detail":{"type":"string"},"layer":{"type":"string","description":"`proxy` | `tunnel` | `tls` | `local`."},"vendor":{"type":["string","null"]}}},"SystemResolutionView":{"type":"object","description":"An issue Oxelone closed by itself, and why. Both fields are always\npresent together. It is never set when a person closed the issue.","required":["resolved_by","note"],"properties":{"note":{"type":"string","description":"Why it was closed, in one sentence."},"resolved_by":{"type":"string","description":"Who closed it: always `Oxelone`."}}},"TagListResponse":{"type":"object","required":["tags"],"properties":{"tags":{"type":"array","items":{"type":"string"},"description":"The tags as saved, after normalisation, alphabetically. Not an echo of\nwhat was sent: `Needs Review` and `needs review` come back as one tag."}}},"TagSuggestionListResponse":{"type":"object","required":["tags"],"properties":{"tags":{"type":"array","items":{"$ref":"#/components/schemas/TagSuggestionView"},"description":"Most-used first. Empty is the honest answer for a workspace that has tagged\nnothing, and is not an error state — the editor opens with no\nsuggestions and accepts whatever is typed."}}},"TagSuggestionView":{"type":"object","description":"One tag, and how much of the workspace already uses it.","required":["name","uses"],"properties":{"name":{"type":"string"},"uses":{"type":"integer","format":"int64","description":"Subjects carrying this tag. What makes the list worth reading: a tag\nused forty times is the workspace's convention and a tag used once is\nprobably somebody's typo, and an alphabetical list of bare strings\ncannot tell you which."}}},"TamperEventView":{"type":"object","description":"One tamper event behind a `machine_tamper` issue, as the agent reported\nit. The refused command itself is never included.","required":["id","at","kind","sentence","damage"],"properties":{"action":{"type":["string","null"],"description":"`self_protect_denied`: what it would have done — `delete`, `stop_service`, …."},"at":{"type":"string","description":"RFC 3339, the agent's clock."},"damage":{"type":"boolean","description":"`false` for a blocked attempt, which changed nothing and never holds *Tampered*."},"detail":{"type":["string","null"],"description":"The agent's short word for the event (`restored`, `shell`, …)."},"id":{"type":"string"},"kind":{"type":"string","description":"What happened: `entry_removed`, `entry_modified`, `file_deleted`,\n`acl_changed`, `user_disable_setting`, `system_path_override`,\n`restore_backoff`, `service_stopped_unsanctioned`,\n`service_dacl_changed`, `binary_mismatch`, `config_mismatch`,\n`companion_killed` or `self_protect_denied`."},"path":{"type":["string","null"],"description":"The target's path, normalised as hook rows are (`~` for a profile)."},"pid":{"type":["integer","null"],"format":"int64"},"process":{"type":["string","null"]},"sentence":{"type":"string","description":"The event described in one sentence."},"target":{"type":["string","null"],"description":"`self_protect_denied`: what was aimed at — `folder` | `hook_settings` | `hook_entry` |\n`service_definition` | `service` | `agent_process` | `policy_registry`."},"tool":{"type":["string","null"],"description":"The AI tool or hooked tool, as a registry slug."}}},"TimelineEntryView":{"type":"object","required":["at","kind","title"],"properties":{"actor":{"type":["string","null"],"description":"The display name of the person who did it, or null when no person did."},"at":{"type":"string","description":"RFC 3339."},"detail":{"description":"The entry's facts, or null when it has none."},"kind":{"type":"string","description":"`config_changed` | `lifecycle` | `diagnostics` | `companion_action` |\n`grant` | `command_queued` |\n`command_delivered` | `command_acked` | `command_expired` |\n`command_quarantined` | `config_applied` | `config_failed` | `restarted` |\n`pause_started` | `pause_ended` | `health_changed` | `gap` |\n`environment` | `surface` | `suspended` | `resumed` | `deleted` |\n`uninstalled` | `self_removed` | `archived` | `unarchived` | `replaced` |\n`tool_coverage` | `ask_unavailable` | `ask_available`."},"title":{"type":"string","description":"One line, composed by the server, in sentence case."}}},"TimelineResponse":{"type":"object","required":["entries"],"properties":{"entries":{"type":"array","items":{"$ref":"#/components/schemas/TimelineEntryView"},"description":"Newest first."},"next_before":{"type":["string","null"],"description":"Pass back as `before`; null on the last page."}}},"ToolBadge":{"type":"object","description":"One AI tool present on a machine.","required":["id","hooked"],"properties":{"hooked":{"type":"boolean","description":"The hooks layer reads `applied` or `witnessed`. False draws the mark dimmed: seen, not hooked."},"id":{"type":"string","description":"A registry slug (`heartbeat-tools.json` → `registry`)."}}},"ToolCallView":{"type":"object","required":["name","n"],"properties":{"n":{"type":"integer","format":"int32","minimum":0},"name":{"type":"string"}}},"ToolCheckView":{"type":"object","description":"One provided AI-tool check: an issue whose `source_id` equals `policy` was raised by this\ncheck.","required":["policy","key"],"properties":{"key":{"type":"string","description":"`approval_bypass`, `shell_auto_approved`, …"},"policy":{"type":"string"}}},"ToolConfigPreviewRequest":{"type":"object","required":["policy"],"properties":{"policy":{"type":"object","description":"The unsaved policy body, in the shape `POST /policies` takes: a Host policy about an AI\ntool, triggered while present.","additionalProperties":{},"propertyNames":{"type":"string"}}}},"ToolConfigPreviewView":{"type":"object","required":["machines_matched","machines_reporting","by_tool","sample","fix_capable","partial"],"properties":{"by_tool":{"type":"array","items":{"$ref":"#/components/schemas/PreviewByTool"}},"fix_capable":{"type":"integer","format":"int64","description":"Matched machines where the agent can fix the setting itself, in a tool the policy matched."},"machines_matched":{"type":"integer","format":"int64"},"machines_reporting":{"type":"integer","format":"int64"},"partial":{"type":"boolean","description":"More than 5,000 reads: the counts are over the newest 5,000."},"sample":{"type":"array","items":{"$ref":"#/components/schemas/PreviewSample"}}}},"ToolCountsView":{"type":"object","description":"Counts for the header, tabs and tiles. **A count that could not be read is omitted, never\n`0`.**","properties":{"agents_and_commands":{"type":["integer","null"],"format":"int64"},"always_allowed":{"type":["integer","null"],"format":"int64"},"marketplaces":{"type":["integer","null"],"format":"int64"},"mcp_servers":{"type":["integer","null"],"format":"int64"},"memory_files":{"type":["integer","null"],"format":"int64"},"open_issues":{"type":["integer","null"],"format":"int64"},"other_hooks":{"type":["integer","null"],"format":"int64"},"over_permissive":{"type":["integer","null"],"format":"int64"},"plugins":{"type":["integer","null"],"format":"int64"},"plugins_enabled":{"type":["integer","null"],"format":"int64"},"sessions_30d":{"type":["integer","null"],"format":"int64"},"sessions_live":{"type":["integer","null"],"format":"int64"},"skills":{"type":["integer","null"],"format":"int64"}}},"ToolCoverageView":{"type":"object","description":"One AI tool as the machine last reported it.","required":["tool","present","layers","gaps"],"properties":{"gaps":{"$ref":"#/components/schemas/ToolGapsView"},"layers":{"type":"array","items":{"$ref":"#/components/schemas/ToolLayerView"},"description":"In the vocabulary's order: hooks, policy, network, tls, trust."},"present":{"type":"boolean"},"tool":{"type":"string","description":"A registry slug."},"version":{"type":["string","null"]}}},"ToolDayView":{"type":"object","description":"One UTC day of the last seven.","required":["day","sessions"],"properties":{"day":{"type":"string","description":"`YYYY-MM-DD`, UTC."},"sessions":{"type":"integer","format":"int64","description":"Sessions whose last activity fell on that day."}}},"ToolFixView":{"type":"object","required":["policy","fix","state","targets","since"],"properties":{"fix":{"type":"string"},"policy":{"type":"string"},"policy_name":{"type":["string","null"],"description":"The policy's name, when it is still one of this workspace's."},"reason":{"type":["string","null"]},"since":{"type":"integer","format":"int64"},"state":{"type":"string"},"targets":{"type":"integer","format":"int32","minimum":0}}},"ToolGapsView":{"type":"object","description":"Hook calls that could not reach the agent in the last seven days, by why.","required":["agent_unreachable","timeout","oversize","pipe_denied","shim_error","busy"],"properties":{"agent_unreachable":{"type":"integer","format":"int32","minimum":0},"busy":{"type":"integer","format":"int32","minimum":0},"oversize":{"type":"integer","format":"int32","minimum":0},"pipe_denied":{"type":"integer","format":"int32","minimum":0},"shim_error":{"type":"integer","format":"int32","minimum":0},"timeout":{"type":"integer","format":"int32","minimum":0}}},"ToolHookSettingView":{"type":"object","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"On: the tool asks the agent before it acts, and the workspace's policies decide. Off: no\nhook is written for it."}},"additionalProperties":false},"ToolHooksView":{"type":"object","description":"The hooks section. `tools` is keyed `claude_code | codex | gemini_cli | cursor | windsurf | copilot_cli | antigravity`;\nin a response every one of the five is present, and on a request an absent tool is on.","required":["fallback","tools"],"properties":{"fallback":{"$ref":"#/components/schemas/HookFallbackView"},"tools":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/ToolHookSettingView"},"propertyNames":{"type":"string"}}},"additionalProperties":false},"ToolLayerView":{"type":"object","description":"One layer of one tool. The words are `heartbeat-tools.json` -> `variants`.","required":["layer","state"],"properties":{"layer":{"type":"string"},"mode":{"type":["string","null"],"description":"`hooks` only: `off` | `open` | `closed`."},"reason":{"type":["string","null"]},"since":{"type":["integer","null"],"format":"int64","description":"Unix seconds, the agent's clock."},"state":{"type":"string"}}},"ToolMachineView":{"type":"object","required":["id","hostname","status"],"properties":{"agent_version":{"type":["string","null"],"description":"The agent build the machine last reported; `null` when unknown."},"hostname":{"type":"string"},"id":{"type":"string"},"last_seen_at":{"type":["string","null"],"description":"The machine's last check-in, RFC 3339; `null` when it has never checked in or the read\nfailed. The Sessions tab's *nothing received yet* checklist names it."},"status":{"type":"string","description":"`active`, `suspended`, `archived`, `uninstalled` or `deleted`."}}},"ToolPageCoverageView":{"type":"object","required":["layers","fixes"],"properties":{"fixes":{"type":"array","items":{"$ref":"#/components/schemas/ToolFixView"}},"layers":{"type":"array","items":{"$ref":"#/components/schemas/ToolPageLayerView"}}}},"ToolPageLayerView":{"type":"object","required":["layer","state"],"properties":{"layer":{"type":"string"},"reason":{"type":["string","null"]},"since":{"type":["integer","null"],"format":"int64"},"state":{"type":"string"}}},"ToolPageView":{"type":"object","required":["artifact","machine","counts","governed_by","rule_additions","fix_capable","sessions_read","lockable","checks"],"properties":{"artifact":{"$ref":"#/components/schemas/ArtifactView","description":"The single-record artifact view, `tool_settings` filled."},"checks":{"type":"array","items":{"$ref":"#/components/schemas/ToolCheckView"},"description":"The provided AI-tool checks (*AI tool safety*, *MCP server safety*), each policy id with\nits key. An issue whose `source_id` is one of these policy ids is a setting issue from\nthat check."},"counts":{"$ref":"#/components/schemas/ToolCountsView"},"coverage":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ToolPageCoverageView","description":"`null` when the machine has never reported this tool."}]},"fix_capable":{"type":"boolean","description":"Whether the agent can fix this tool's settings by writing its enforced settings file."},"governed_by":{"type":"array","items":{"$ref":"#/components/schemas/GovernedByView"}},"lockable":{"type":"boolean","description":"Whether this tool can be locked: its hooks can refuse."},"machine":{"$ref":"#/components/schemas/ToolMachineView"},"recent":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ToolRecentView","description":"The last seven days of sessions; `null` when they could not be read."}]},"rule_additions":{"type":"array","items":{"$ref":"#/components/schemas/RuleAdditionView"},"description":"At most 200, newest first."},"sessions_read":{"type":"boolean","description":"Whether the agent can read this tool's sessions. When `false`, there are no sessions to\nlist."},"tool_lock":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SessionLockView","description":"The live tool-wide lock on this tool on this machine, or `null` when it is not locked."}]}}},"ToolRecentView":{"type":"object","description":"The tool's last seven days of sessions. Absent when they could not be read, never reported\nas zeros.","required":["days","sessions","prompts","projects"],"properties":{"days":{"type":"array","items":{"$ref":"#/components/schemas/ToolDayView"},"description":"Seven UTC days ending today, oldest first; a day with no session is `0`."},"last_session_at":{"type":["string","null"],"description":"The newest `last_at` of any session ever received; `null` when none ever was."},"projects":{"type":"integer","format":"int64","description":"Distinct named projects across those sessions."},"prompts":{"type":"integer","format":"int64","description":"Prompts across those sessions."},"sessions":{"type":"integer","format":"int64","description":"The sum of `days`."}}},"ToolRestrictionsView":{"type":"object","description":"The restrictions section, keyed `local_mcp_servers | extensions | extension_directory`.\nAn absent key is not set.","additionalProperties":{"$ref":"#/components/schemas/RestrictionValueView"},"propertyNames":{"type":"string"}},"ToolSessionDetail":{"allOf":[{"$ref":"#/components/schemas/ToolSessionView"},{"type":"object","required":["transcript","tool_calls","more_tools","mcp_servers","modes"],"properties":{"mcp_servers":{"type":"array","items":{"type":"string"},"description":"Derived from `mcp__<server>__<tool>` names."},"modes":{"type":"array","items":{"$ref":"#/components/schemas/ModeSpanView"}},"more_tools":{"type":"integer","format":"int32"},"tool_calls":{"type":"array","items":{"$ref":"#/components/schemas/ToolCallView"}},"tool_version":{"type":["string","null"]},"transcript":{"type":"string"}}}]},"ToolSessionView":{"type":"object","required":["session_id","started_at","last_at","live","length_seconds","prompts","tool_calls_total","interactions","saved_rules"],"properties":{"first_prompt":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/FirstPromptView"}]},"interactions":{"$ref":"#/components/schemas/SessionInteractionsView"},"last_at":{"type":"string"},"length_seconds":{"type":"integer","format":"int64"},"live":{"type":"boolean"},"lock":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SessionLockView","description":"The live lock on this session, or `null`. A tool-wide lock is reported once, as the\ntool's `tool_lock`, and not repeated on every session."}]},"model":{"type":["string","null"]},"oversight":{"type":["string","null"],"description":"The session's last permission mode, as an oversight word."},"project":{"type":["string","null"]},"prompts":{"type":"integer","format":"int32"},"saved_rules":{"type":"array","items":{"$ref":"#/components/schemas/SavedRuleView"}},"session_id":{"type":"string"},"started_at":{"type":"string"},"tool_calls_total":{"type":"integer","format":"int32"},"withheld":{"type":"boolean","description":"The caller may not read interaction content, so no first prompt is shown."}}},"ToolSessionsPage":{"type":"object","required":["items","total"],"properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ToolSessionView"}},"next":{"type":["string","null"]},"total":{"type":"integer","format":"int64"}}},"ToolSettingsView":{"type":"object","description":"One tool's settings on one machine, as last read.","required":["read_at","received_at","sources","settings"],"properties":{"read_at":{"type":"string","description":"RFC 3339, the endpoint's clock."},"received_at":{"type":"string","description":"RFC 3339, this server's clock."},"settings":{"type":"array","items":{"$ref":"#/components/schemas/SettingView"}},"sources":{"type":"array","items":{"$ref":"#/components/schemas/SettingSourceView"}}}},"TriageRequest":{"type":"object","required":["status"],"properties":{"status":{"type":"string","description":"`open`, `acknowledged`, `resolved` or `suppressed`.\n\n`suppressed` only hides the issue from the default list; it stops\nnothing. Alerts keep being written and `last_seen_at` keeps moving. To\nsilence an issue, mute it with `POST /issues/{issue}/mute`, which takes\na reason and an expiry and is audited."}}},"UndeterminedReasonCount":{"type":"object","required":["reason","count"],"properties":{"count":{"type":"integer","format":"int64"},"reason":{"type":"string"}}},"UnlockResponse":{"type":"object","description":"What Unlock answers.","required":["lock","machine"],"properties":{"lock":{"$ref":"#/components/schemas/SessionLockView","description":"The lock, now `unlock_pending`."},"machine":{"type":"string","description":"The machine the unlock reaches at its next check-in, by hostname."}}},"UnmatchedEndpointView":{"type":"object","description":"One endpoint this machine sent to that no capture rule matched. A count of\nrequests, never their content.","required":["host","endpoint","method","hits","first_seen","last_seen"],"properties":{"endpoint":{"type":"string","description":"The path, as the agent reported it, without query or fragment."},"first_seen":{"type":"string"},"hits":{"type":"integer","format":"int64","description":"How many requests went there. A thousand requests are one row that\ncounts to a thousand."},"host":{"type":"string"},"last_seen":{"type":"string"},"method":{"type":"string"}}},"UpdateComponentOutcomeView":{"type":"object","description":"One component of the release, on this machine's platform, as the agent\nsaid it handled it.","required":["component","outcome"],"properties":{"component":{"type":"string","description":"`agent` | `companion` | `hook` | `tun-driver` | `tun-licence`, as the\nagent named it."},"detail":{"type":["string","null"]},"name":{"type":["string","null"],"description":"The installed file's name, when the agent gave one."},"outcome":{"type":"string","description":"`placed` | `skipped`. The agent's word, kept as given: one this\nserver does not know is still shown."}}},"UpdateGroupRequest":{"type":"object","description":"A change to an own group. Absent fields are left as they are; `policy_ids`\nreplaces the members, in order.","properties":{"description":{"type":["string","null"]},"name":{"type":["string","null"]},"policy_ids":{"type":["array","null"],"items":{"type":"string"}}}},"UpdateMachineRequest":{"type":"object","properties":{"attachment_encrypted_archives":{"type":["string","null"],"description":"The per-machine attachment overrides, with the same three states as\nthe scan fields: absent leaves it, `null` clears back to inheriting,\na value sets one. Validated in-handler so the refusal names the field."},"attachment_fail_mode":{"type":["string","null"]},"capture_strategies":{"description":"Refused if sent: the set of strategies is fixed when the machine\nenrolls. To switch one of them on or off, use\n`PATCH /machines/{id}/strategies/{strategy}`."},"capture_tactic":{"description":"Refused if sent, even as `null`: a machine's capture tactic is fixed\nwhen it enrolls, and sending it is a 400 that says so."},"collect_artifact_content":{"type":["boolean","null"],"description":"The per-machine content-collection override, three-state like the panel\nfields above. **Not** `collection_enabled`: that switch decides whether\nthis machine observes AI traffic at all, this one only whether file\ncontents may be collected from it."},"collection_enabled":{"type":["boolean","null"],"description":"Whether the machine is currently collecting at all.\n\nThree-state like everything else below: omitting it leaves collection as\nit was. It was briefly a required `bool`, which made every existing\ncaller send a value for a field it had no opinion about — and a caller\nthat has to restate the current setting to change something else will\neventually restate it wrongly."},"disabled_strategies":{"type":["array","null"],"items":{"type":"string"},"description":"Strategy ids to switch off on this machine. `null` returns to the profile,\n`[]` runs everything enrolled; a strategy the machine never enrolled is 400."},"log_level":{"type":["string","null"],"description":"The per-machine log-level override, with the same three states as the\nscan fields: absent leaves it alone, `null` clears it back to inheriting\nfrom the profile, a value sets one. An unknown level is a 400 naming the\naccepted levels."},"machine_group":{"type":["string","null"],"description":"Which group this machine belongs to. The enrollment profile sets the\nfirst value; it can be changed. `null` returns the machine to\nungrouped; omitting the field leaves it alone."},"panel_show_collection":{"type":["boolean","null"]},"panel_show_steering":{"type":["boolean","null"],"description":"The per-machine panel overrides, three-state like the attachment fields\nabove."},"scan_categories":{"type":["array","null"],"items":{"type":"string"}},"scan_enabled":{"type":["boolean","null"],"description":"The per-machine scan override; the same applies to every `scan_*`\nfield. Each has three states: omitting it leaves the stored value\nalone, `null` clears the override so the field inherits from the\nprofile again, and a value sets one."},"scan_full_hours":{"type":["integer","null"],"format":"int32"},"scan_max_depth":{"type":["integer","null"],"format":"int32"},"scan_max_files":{"type":["integer","null"],"format":"int32"},"scan_roots":{"type":["array","null"],"items":{"type":"string"}},"scan_skips":{"type":["array","null"],"items":{"type":"string"}},"scan_smart_minutes":{"type":["integer","null"],"format":"int32"},"tool_hooks":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ToolHooksView","description":"This machine's own hooks section. Three-state like the fields above:\nabsent leaves it, `null` clears back to the profile, an object replaces\nthe profile's whole section on this machine. A tool outside the five is\na 400."}]},"tool_restrictions":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ToolRestrictionsView","description":"This machine's own tool restrictions, each key `allow` | `block`, an\nabsent key not set. Three-state like `tool_hooks`; an unknown key is a\n400."}]}}},"UpdateOutcomeView":{"type":"object","description":"What an update did on the machine, in the agent's own account. An\nendpoint's word: shown, and trusted for nothing.","properties":{"components":{"type":"array","items":{"$ref":"#/components/schemas/UpdateComponentOutcomeView"}},"reconcile":{"type":"array","items":{"$ref":"#/components/schemas/UpdateReconcileStepView"}},"retired":{"type":"array","items":{"$ref":"#/components/schemas/UpdateRetiredOutcomeView"}}}},"UpdateReconcileStepView":{"type":"object","description":"One step of the new build's first start bringing the install up to date.","required":["step","outcome"],"properties":{"detail":{"type":["string","null"]},"outcome":{"type":"string","description":"`ok` | `changed` | `deferred` | `failed` | `interrupted`, as the agent\nsaid it."},"step":{"type":"string"}}},"UpdateRetiredOutcomeView":{"type":"object","description":"One file an older build installed and this release retires.","required":["name","outcome"],"properties":{"detail":{"type":["string","null"]},"name":{"type":"string"},"outcome":{"type":"string","description":"`removed` | `absent` | `failed` | `refused`, as the agent said it."}}},"UsageResponse":{"type":"object","required":["services"],"properties":{"services":{"type":"array","items":{"$ref":"#/components/schemas/ServiceUsageView"}}}},"ValueShapeView":{"type":"object","description":"The shape of a filter field's value, and the list it is chosen from, if\nany.","required":["shape","closed"],"properties":{"closed":{"type":"boolean","description":"Whether that list is the only permitted set of values. When false, the\nlist is suggestions and any value may be written."},"options":{"type":["string","null"],"description":"The list the server supplies, when the shape names one. `null`\notherwise."},"shape":{"type":"string","description":"`text` | `regex` | `number` | `enum` | `duration` | `time_of_day`. A\n`time_of_day` window may wrap past midnight (22:00–06:00)."}}},"VerdictSummaryView":{"type":"object","description":"How many of this person's presences each verdict fell on. All three\ncounts are always present, zeros included.","required":["enterprise","personal","unknown"],"properties":{"enterprise":{"type":"integer","format":"int64"},"personal":{"type":"integer","format":"int64"},"unknown":{"type":"integer","format":"int64"}}},"WinnerView":{"type":"object","required":["decision","policies","require_reason"],"properties":{"decision":{"type":"string","description":"`allow`, `ask` or `block`, the strictest of the matched policies winning, or\n`undetermined` when the outcome waits on an engine result, which a simulation does not\nrun. For an Ask with no companion running this is still `ask`; what happens then is\n`if_no_companion`'s sentence."},"message":{"type":["string","null"],"description":"The merged question, as the person would read it; `null` for Oxelone's default wording."},"policies":{"type":"array","items":{"$ref":"#/components/schemas/PolicyRefView"},"description":"The policies that decided it: every merged Ask, or the blocking ones."},"require_reason":{"type":"boolean"}}},"WorkspaceOverviewResponse":{"type":"object","required":["window_days","totals","days","services","total_services","tools","total_tools","edges","issues"],"properties":{"days":{"type":"array","items":{"$ref":"#/components/schemas/OverviewDayView"},"description":"Oldest first, zero-filled, exactly `window_days` long."},"edges":{"type":"array","items":{"$ref":"#/components/schemas/OverviewEdgeView"},"description":"At most 100."},"issues":{"$ref":"#/components/schemas/OverviewIssuesView"},"services":{"type":"array","items":{"$ref":"#/components/schemas/OverviewServiceView"},"description":"Largest first by interactions, then by name; at most 20."},"tools":{"type":"array","items":{"$ref":"#/components/schemas/OverviewToolView"},"description":"Largest first; at most 20."},"total_services":{"type":"integer","format":"int64","description":"Distinct services before the cap."},"total_tools":{"type":"integer","format":"int64","description":"Distinct tools before the cap."},"totals":{"$ref":"#/components/schemas/OverviewTotalsView"},"window_days":{"type":"integer","format":"int32","description":"The window actually used, after clamping."}}}},"securitySchemes":{"apiKey":{"type":"http","scheme":"bearer","bearerFormat":"oxel_…","description":"An API key from Settings › Access › API keys, sent as `Authorization: Bearer oxel_…`. It acts as one role in one workspace and always expires."}}},"tags":[{"name":"overview","x-displayName":"Overview","description":"The workspace's posture at a glance: counts and names, never content."},{"name":"posture","x-displayName":"Posture","description":"Every shipped posture check, by AI risk."},{"name":"alerts","x-displayName":"Alerts","description":"Alerts raised by policies."},{"name":"detections","x-displayName":"Issues","description":"The standing conditions alerts group into, their triage and mutes."},{"name":"activity","x-displayName":"Activity","description":"Interactions, file events, scans and comments."},{"name":"inventory","x-displayName":"Inventory","description":"AI tools and artifacts found on the fleet."},{"name":"machines","x-displayName":"Machines","description":"Enrolled machines: their state, activity and coverage."},{"name":"accounts","x-displayName":"Accounts","description":"People, the presences folded into them, and their history."},{"name":"policies","x-displayName":"Policies","description":"Policies: authoring, lifecycle, hits and simulation."},{"name":"observations","x-displayName":"Usage","description":"Usage the fleet observed."}],"security":[{"apiKey":[]}],"servers":[{"url":"https://api.oxelone.com"}]}